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Report of: Se ———— Office: Alexandria, Virginia ek 
Date: 2/17 84 


Field Office File #: 196A-633 Bureau File #: 
Narrative of Offense: 


General Telephone and Electronics (GTE) owns 
and operates a computer network known as Telenet which 
links various subscriber companies and Government agencies 
through a tie-in system in numerous cities throughout 
the United States. Access is obtained by calling a published 
telephone number in various cities. 


Within the Telenet System is a service called 
Telemail which offers a computerized message capability 
between Telemail customers and any Telemail subscriber 
company. Each Telemail subscriber is responsible for 
designating an "in house" administrator to oversee all 
administrative functions of the customer's Telemail service, 
including the assignment of passwords to gain access to 
the system and the subscriber company. The administrator 
for a new user company may set up various subdivisions 
and individual users in his own company as he sees fit. 


In August, 1983, GTE discovered that the accounts 
of approximately 18 Telemail subscribers had been accessed 
by unauthorized intruders from different areas of the 
country. The intruders gained access to certain customers' 
Telemail subscribers accounts by determining password 
assigned to Telemail subscribers through a process called 
"hacking". By this process, the "hacker" chose a subscriber 
account, such as Raytheon, NASA, USDA, RADA Corporation, 
Coca Cola USA, 3M Corporation. The "hacker" then tried 
numerous successive passwords (e.g., each letter of the 
alphabet, or the administrator's first name, etc.) until 
the correct password was discovered. Many hackers programmed 
their home computer to systematically try passwords for 
hours at a time. Once the hacker had broken a customer's 
password, he entered the Telemail System as if he were 
the legitimate subscriber. He did this by calling a published 
Telenet dial-in number and then placing his telephone 
on his modem hookup. This modem hookup allowed him to 
type on his home computer keyboard and have the impulses 
sent through the telephone system into the Telenet computer 
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system. He then typed in the command "Mail" and entered 

the Telemail message system. At this point the computer 
prompted him with "User Name?". He then typed in the 

words (for example) ADMIN/NASA. The computer then prompted 
with "Password?" and he then typed in the password that 

he had discovered through hacking. At this point he was 
accepted by the system as a legitimate subscriber, and 

was able to perform many of the functions that the subscriber 
can perform, all of which would be charged to the legitimate 
subscriber. At this point some of the hackers created 

a pirate subdivision in the legitimate subscriber organization, 
such as ADMIN/inner circle/NASA and set up user names 

in that new "pirate" account. User names may be any compilation 
of letters and numbers, but are usually a first initial, 
period, then last name .o Eeeaa The hacker, 

as administrator of his own subdivision, then set up passwords 
for all his users, notified them of their user name and 
password and they could now enter Telemail with their 

names and passwords. These users could now leave messages 

on the system to an individual in the group, to the pirate 
administrator or (because the computer believed they 

are legitimate) to any other user (legitimate or illegitimate) 
in the entire Telemail system. 


On October 13, 1983, immediately before FBI 
Agents began a search of the WUSB Radio Station, State 


University_of New York at B k, Stony Brook, 
New York,[____]told fo, G0 atte eae 
room and remove certain items from that room to prevent 


those items from being seized. did remove certain 
items from the room. 
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PROSECUTIVE STATUS: 


1. On August 30, 1983, the available facts in this 
Matter were presented to Elsie Munsell, United States 
Attorney, Eastern District of Virginia, who advised she 
would consider prosecution in the matter. 


2. On October 13, 1983, the premises located at 
and WUSB 
Radio Station, State University of New York at Stony Brook, 
Stony Brook, New York, was searched pursuant to a duly 
authorized federal search warrant and various computer 
paraphenalia were seized. 
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WITNESSES: 


» [| 
elemal 


2. 


4. 


8229 Boone Boulevard 

Vienna, Virginia 

Telephone[___] 

Can provide details of GTE Telemail operations, 
methods of detecting unauthorized users and 


procedures for obtaining print-outs of customer 
messages. 


Special Agent 
Federal Bureau of Investigation 


Can supply details of investigation. 


Special Agent . 
Federal Bureau of Investigation, New York 


Can supply details concerning search of WUSB 


Radio Station, State University of New York 
at Stony Brook. 


Special Agent 
Federal Bureau of Investigation, New York 


Can supply details concerning search of 


Can supply details of admissions made by 
[__|to him, as well as details about 
extent of intrusion into GTE Telemail by 
and others. 


Full text in report section, pages 7 ~ 16, attached. 
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Telephone 

Can provide details of use of telephones 
and computers at WUSB, as well as details concerning 
[____Jana[___]snvolvement in removal of 
evidence prior to FBI search. 


Full text in report section, pages 17 - 18, attached. 
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EVIDENCE: 
ry of 57 messages placed on_GTE Telemail 
b (originals in possession off 
GTE Telemail). 
2. Copy of 302 concerning search with attached 


list of items seized. 

3. List of items from WUSB Radio Station, State 
University of New York, relevant to Telemail (originals 
in possession of Alexandria FBI). 


4. List of items fromn[ —sSdt rl@eevaannt 
to Telemail (originals in possession of Alexandria FBI). 


j charges for 
(original in possession o . 
6. Co of messages sent to GTE Telemaii[ 
(originals 
in possession of . 


7. Copy of investigative reports provided by 


es Attorney for State University of New York at 
Stony Brook, concerning 
8. Copy of letter from[ sith enclosed 


copy of "2600" magazine. 


9. FD-302 summarizing trap and trace information 


and 
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12/14/83 


Date of transcription 


1 
The followi j sag £ the 
illegal user known as and on he 
the GTE Telemail System. ~ : ; : aia 


The date and time of each message is provided, with a 
synoposis of particularly significant messages included. 


l. July 9, 1983, 11:42 p.m. (All times Eastern Daylight Time) 
This message discusses a Source Account and states 


in part "Some of you mentioned hacking timecor and Bé 
task force. What exactly are those and how are the aa 
accessible?. I await your replies.” oe al 
2. July 10, 1983, 4:28 a.m. Message reads as follows: 
"Hi, folks -[ fon assiunment. The following 
will either be Iong and boring or informative and b6 
interesting, or maybe a combination. Looks ilke b7c 
Southern Bell has some sort of relationsnip with 
Telenet." This is followed by a forwarded messace 
from the Telenet Company that discusses "Soutnern 
Bell marketing opvortunities for 1983/84." 
3. July 14, 1983, 5:41 p.m This is again a forwarded 
message concerning the Telemail Account of Citibank. 
4. July 15, 1983, 3:21 a.m. This is a forwarded message 
from to all members of the Phalse group. ae 


The message is a listing of the projections of the 
1984 Telemail Revenues. This message lists every 
current and projected Telemail account number and the 


“ projected revenue for 1984, 
5. July 15, 1983, 3:25 a.m. This is another message from b6 
[lt all members of the Phalse group, concerning b7C 
Telenet information. 
6. July 15, 1983, 11:27 p.m. This message discusses the 


idea of a publication called "2600 Magazine" with articles 
to discuss phone phreaking and computer hacking. 


TBE 
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Continuation of FO-302 of ...__Summary of Messages ————______--.. 


7. 
8. 
9. 


10. 


ll. 
12. 


13. 


14. 
15. 


16. 
17. 
18. 


< 


On 12/24/83 . Page 2 


July 10, 1983, 11:47 p.m. 
July 11, 1983, 1:02 a.m. 


July 16, 1983, 2:07 a.m. This message reads in part, 
"Yea, I have been thinking about distribution. So far 
we have reliable boxes in Colorado, Chicago and 

Long Island. I'm looking for a way right now of opening 
up a box in Grand Central Station or something." This 
message goes on to discuss ways that mail would 
immediately. be forwarded to a different post office box 
so that the boxes could not be traced. 


July 18, 1983, 3:02 p.m. This message states, 


ig the ID for the space station infermation." Signed b6 
b7C 


July 18, 1983, 8:10 p.m. 


July _13, 1933, 10:47 p.m. This is a message from 
tol The message begins,[__|(from and 
continues, "Give thanx, that you're not wanted dred (Sic) bé 


or alive. I'll be jammin with you tomorrow. Time to b7Cc 
draw my brakes. What a plot! Police and thieves on my 


back. I sense go back home to my tenament yard. 


July 24, 1983, 11:16 p.m. This message states, "I found 
this somewhere, but can't seem to get the procedure 

right. Any suggestions?” This is followed by the listing 
of a Telemail customer, computer application services and 
passwords for that customer. 

July 25, 1983, 2:38 a.m. 


August 2, 1983, 2:49 a.m. This message is entitled, “Your 

Tealenet Guide,” and discusses administrative functions 

of the Telemail system. 

August 3, 1983, 1:30 a.m. 

August 4, 1983, 4:05 a.m. 

August 5, 1983, 7: m In this message| _—iis asking 
aka what the price range is b6 

or printing stationery. n a previous message,[ | BIC 

indicated that[ —_—Jworked in a print shop. 
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Continuation of F0-302 of___ Summary of Messages _ On__12/14/83  , Page __ 3 


19. August 8, 1983, 2:ll a.m. This message refers to 
and “hacking up a storm" on "Black". 
ack was their pseudonym for an IBM voice message 


system they were illegally using. ee 


b7C 


follows, but Phalse isn't known by anyone 
yet. Is it? This is really the only place I've 
seen mentioned of it, unless they have bugs on 

ADS (which I really doubt), there's no real record 
Phalse anywhere. I think perhaps we should change 
our name when hacking perhaps, but then again it's 
always possible that some faithful follower 
(Phalse aurounies) will do things in our name (or 
we could say that, anyway!) " 


20. August 8, oor i0:13 p.m. This message reads as 


21. August 17, 1983, 19:13 p.m. 


22. August 21, 1923, 11:45 p.m. This message discusses, 
' "Green, golc, and black.” These are IBM voice 
message Systems that these people were using illegally. 


23. August 23, 1933, 9:48 p.m. 
24, - August 24, 1983, 11:34 p.a. 
25. August 26, 1983, 4:45 p.m. 


26. August 29, 1983, 4:17 p.m. This message is entitled, 
"Arpa” and states in part, "I was able to get inside 
their Centrex using that 800 number I told you about.” 


27. August 31, 1983, 12:43 a.n. 
28. August 31, 1983, 4:08 p.m. 


‘29. August 31, 1983, 11:20 p.m. The statement reads in part, bé6é 
"Hi,[__} Good to see you got onto the system alright. b7C 
Welcome to the Phalse network. Our purpose is to exchange 
all kinds of info as quickly and efficiently as possible. 
This system is one of our resources. If.you'd like 
to see some of the stuff we've been up to, look in EMLE. 

The PW is the same as yours when you logged in." 
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Continuation of FD-302 of . _ 


30. 
31. 


32. 


33. 
34. 


35. 
36. 
37. 
38. 


September 8, 1983, 3:56 a.m. 


September 8, 1983, 5:37 aem. In this message,|__ 
forwards a message from a Telenet official to @ 

Telenet users discussing unauthorized access to customer 
computer systems. 


September 8, 1983, 10:15 a.m. This message reads as 
follows, "The situation at Telenet continues to be 
unsettled, as those of you on the ‘A’ System can see on 
the BBS. Therefore the the moratorium against hacking 
Telemail accounts has been extended until the end of 
September. At that time, we can continue with a vegence 
and introduce the new people into the ways of the 
‘usercode.' . ‘ 

A new Arpa update has been sent to those currently 
involved in the TAC HAC Project. We still do not have 

a date on password cutover, although the end of the year 
has hinted at for MILNET implementation. We still need 
guest accounts on MIT and SRI hosts, as well as a new 
FTP NOCS. Anyone with info on any of these should pass 
it on via the Arpa list. 

And last but not least, another reminder not to take the 
Telemail Customer Survey they are touting on the BB. 

It is partly designed as a trap to validate authorized 
system users, and our unregistered area which stands 

out like a sore thumb should they take a closer look. 
Later, all." Signed, _and is followed by 

"P.S.: OSUNY Lives!® 

September 11, 1983, 5:13 p.m. 


September 11, 1983, 5:19 p.m. This message states, 


. “Folks, should we risk sending to these people from 


our own accounts? Personally I'd feel better if we 
had accounts over in their area in case as a clampdown 
px Soap thing: Please let me know the facts." Signed, 
September 12, 1983, 8:00 p.m. 

September 12, 1983, 11:51 p.m. 

September 13, 1983, 5:26 p.m. 

September 14, 1983, 11:30 p.m. 
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Continuation of FD-302 of . . 


39. 
40. 
41. 
42. 
43. 
44. 
45. 
46. 
47. 
48. 


49. 
50. 
Sl. 
52. 
53. 


54. 


55. 
56. 
57. 


September 


September 
September 
September 
September 
September 
September 
September 


September 


September 29 
byL | 
the iilega 


1 


1 


7, 


8, 


sages 


1983, 
1983, 
1983, 
1983, 
1983, 
1983, 
1983, 
1983, 
1983, 
1983, 


with each other. 


2:06 am. 
9:36 p.m 
10:05 p.m. 
10:05 p.m. 
2:03 a.m. 
8:34 p.m. 
8:51 p.m. 
5:54 p.m. 
11:21 p.m. 
8:29 p.m. 


September 30, 1983, 5:23 p.m. 


October 1, 1983, 3:22 a.m. 


October 


3, 1983, 12:05 p.m. 


October 6, 1983, 12:13 a.m. 


October 


bez 10, 1983, 7:05 


to 


10, 1983, 1:42 a.m. 


oMe 


and states, 


October 12, 1983, 12:13 a.m. 
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This message is an exhortation 
for all members of the Phalse group to use 
systems more frequently to keep in contact 
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Date of transcription 


10/25/83 


On October 13, 1983, at 11:55 AM, a search warrant was 
executed at room 249 of Student Union Building Number 37 at the 
State University of New York at Stony Brook, New York, b ecial 
Agents (SA's 

and 
thls Location. 


No vertinent property was found at 


of WUSB, advised that 
there was nersonal computer equipment belonging to 
in room '227 of the same building and that the telephones 
in room 227 were part of the same system as those in room 240. 
indicated that ne had control over room 227 and would 
allow access. He proceeded to give his written consent for the 


Special Agents of the Federal Bureau of Investigation (FBI) to 
enter room 227. 


At 12:30 °M, Magistrate SHIRA A. SCHEINDLIN of the 


Eastern District of New York at Brooklyn, New York, was contacted 
telephonically by Special Agent and advised of the change 
in room locations and of consent. SCHEINDLIN proceeded 


to authorize a search of room 227, 

At 12:35 PM a search of room 227 was begun and the 
search was terminated at 2:15 PM. The search and _ inventory of 
property taken were made in the presence ofl a 
volunteer employee of WUSB and part time user of the computer 
system. 


At the time of the search, the Special Agents observed 
that the computer system in room 227 was connected to the 
telephone system. 


Attached is a copy of the. inventory of the property 
taken from room 227. 
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Date of transcription 11/14 /83 


The following is a review of items seized in a 
court-authorized search of the WUSB Radio Station premises 
at the State University of New York at Stoneybrook on 
October 12751983. The following items of relevance to this 

(5.4 investigation were found: 


1) A computer print-out labeled "Telemail System 
Command Manual," printed September 20, 1983. This print-out 
contains all Telemail System commands. This information would 
normally be obtainable only by a legitimate Telemail administrator. 


2) This item is another copy of the "Telemail System 
Command Manual." 


3) A computer print-out titled "CP/M Modem Program 
Version 7.4." This is a program that will automatically search 
for other computer numbers through the telephone system. 

4) x. computer print-out beginning "Welcome to My Data 


Base Sys t-out also contains the statement 
"Hello, 


5) A print-out entitled "Free Access Computerized BBS 


Directory." Copyright by Peter J. Keller. This print-out also 
bears the adaress| ___| bata Base System, care of Tower Systems, 


196 Main Street, Lincoln Park, New Jersey 07035, followed by 
the words Modem: 201/694-7425. 


6) A white envel 3 ddress:[ 


e 
ls address to WUSB Radio Station, Attention: 


7) A print-out titled "Jerihug Computer Club Finances 


b6 
b7C 


as of 6/10/82." This print-out contains a list of names and expenses. 


8) A box of business cards labelled "Litel Systems, 


Incorporated, 285 Locust Drive in so 
has the name 
and the telephone n er 


Investigation on__L 2/10/83 «Alexandria, Virginia .,,,Alexandria 196A-633 
OO Sub E 
SA k : ll b6 
by ar Date dictated /14 /8 3 b7c 


This document contains neither recommendations nor conclusions of the FBI. it is the property of the FSI and is foaned to your agency; 
it and its contents are not to be distributed outside your agency. 
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b6 
b7¢c 
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AX 196A-633 Sub E 2 


9) A computer print-out listing numerous bulletin 
boards and telephone numbers. 


10) A computer print-out of telephone numbers, including 
numerous Telenet access numbers and Arpanet access numbers. 
This print-out also includes a handwritten note: 914/725-4064, 
Osuny. It also bears the number 800/424-6000, followed by the 
words Telenet 800. This print-out also has a "Connect address" 
for the Source. 


F-10 


FD-302 


(Rev. 3-10-82) @ @ 


FEDERAL BUREAU OF INVESTIGATION 


Date of transcription 


The following is a review of items seized ina 
search | Sa a eR | 


1) 1 i includi e 
numbers for 
an 


2) A yellow piece of paper with the words 
{__Jana/or[ and the area code 213 follow 
phone numbers. One of these numbers is area code 

3) Photocopy of article entitled "Telecorder" with 


a typewritten note signed was a member of the 
Phalsers who went by the user name 


4) Telephone bill for the number[_ si, 


dated August 22, 1983, with toll charges. 
5) White envelope with the number[_ ion it. 


6) 1982 personal pocket diary off st 


7) A New York telephone brochure with numerous 
telephone numbers written on it. 


8) Telephone bill for number[ dated 


June 22, 1983. 


9) Telephone bill for the number[ si, 


dated April 22, 1983. 
10) Telephone bill for above number, dated May 22, 1983. 


11) Telephone bill for above number, dated 
February 22, 1983. 


12) An orange 3 by 5 card with numerous names and 
addresses on it. 


11/10/83 Alexandria, Virginia Alexandria 196A-633 


investigation on OU ace a ll 


by 


Date dictated 


sata 1/14/83 


This document contains neither recommendations nor conclusions of the FBI. It is the property of the FBI and is loaned to your agency; 
it and its contents are not to be distributed outside your agency. 
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11/14/83 


b6 
b7c 


b6 
b7C 


b6 
b7Cc 


b6é 
b7Cc 


b6 
b7c 


b6é 
b7¢ 


' b6 


b7C 
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13) A computer print~out starting with 
"Dial Your Match Commands" and the words "TUC BBS," followed 
by a phone number. 


14) A small scrap of yellow paper with the number 
on it. 
15 A white scrap of paper with t 
- (illegible), 


16 A brown scrap of paper with the address 
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FD-302 (Rev. 3-]0-82) ® @ 


FEDERAL BUREAU OF INVESTIGATION 


L 1/20/84 


Oate of transcription 


The "floppy discs* that were seized in search 
of the WUSB radio station at the State Universi 


York, Stony Brook, New York, w examined by b6 
a computer programmer. indicated that the discs bic 
appear to have no information on them pertaining to GTE 
Telemail. 
nae 1/17/84 Alexandria, Va. alexandria 196A-633 
nvestigation on MG a es ge ee IIE ct ee 


; £9 b6 


This document contains neither recommendations nor conclusions of the FBI. it is the property of the FBI and is loaned to your agency; 
it and its contents are not to be distributed outside your agency. 


by 
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t D$U2 (Rev. 3-12! ea , @ 


FEDERAL BUREAU OF INVESTIGATION 
Date of transcription L/ 31 £8 4 


On January 24, 1984, 


Lae GTE-Telemail, provided a copy of the amount of money es 
ost by GTE Telemail from the unauthorized use by the hackers. e 
This document is broken down by user and by company. 
Many of the hackers had two or more user names, 
therefore the following will be a summary of the above document, 
indicating totals by each user, combining multiple user names 
(this summary covers the months of July, August and September 
for each company): 
USER COMPANY AMCUNT MONTHS 
[| AHSC | $62.29 July, August, 
septemper 
DAY $31.00 September 
| . © b6 
[ Maraven $16.00 August, September bic 
Telenet - $108.00 July, August 
_._ as $0,29 September 
$127.58 
[| CBOT $2.00 September 
b6 


[ RADA $1.00 September bic 


$3.00 
[ Maraven °$24.00 August 
Telenet $325.00 July b6 
b7C 
Telenet $151.00 August 
ences 
Investigation on_____ 1/25/84, Alexandria, Virginia ri, Alexandria 196A-633 
; b6 
SA sfk Date aictatea___ 1/25/84 BTS 


by 


This document contains neither recommendations nor conclusions of the FBI. it is the property of the FBI and is loaned to your agency; 
it ang its contents are not to be distributed outside your agency. 
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USER 


(Continued ) 


| 


= 
= 
= 


COMPANY 


BMW 

BMW 
Maraven 
BMW 
BMW 
Raytheon 


Scannet 


Maraven 
Telenet 
Telenet 
BMW 
UAW 


Scannet 


BMW 
BMW 
Maraven 
Maraven 
Maraven 
Maraven 


AHSC 


AMOUNT 


$55.00 
$40.00 
$1.00 


$4.00 


$0.17 
$144.00 
$59.00 
$11.00 
$5.00 


$6.00 
$225,517 


$3.00 
$0.17 
$1.00 
$8.00 


$132.00 


$196.17 


MONTHS 


September 
August 
September 
sapeanber 
August 
September 


September 


August 
July 
August 
September 


September 


September 


September 
August 
September 
August 
July 
August 


August 


b6 
b7Cc 


b6 
b7c 


b6 
b7C 
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USER 


[| 


J 


COMPANY 


AHSC 
Telenet 
Teleanet 


AHSC 


AHSC 
AHSC 
Raytheon 
Raytheon 


RADA 


AHSC 


AMOUNT 


$0.55 


$6,00 
$119.55 
$64.00 


$10.00 


$3,00 
$179.57 


$86.00 


$8.00 


MONTHS 


September 


July 


August 


September 


August 


September 


September 


August 


° 


September 


August, 


August, 


September 


September 


September 


September 


September 


September 


September 


b6 
b7c 


b6 
b7C 


b6 
b7c 


b6 
b7C 


b6 
b7Cc 
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USER 


= 
a 


= 
7 


——— 
[ 
[| 
es 
ay 
[i 


CBOT 


RADA 


MMM 


COMPANY 


__AMOUNT _ 


$103.00 


$114.00 


$87.00 
SLB. 52 
$0.76 


$287.00 
$393.28 


MONTHS 
“September 
September 


September 


September 
August, September 
September 


September 


September 
September 
September 


September 


August, September 
September 


September 


August, September 
September 


September 


b6 
b7C 


b6 
b7C 


b6 
b7C 


b6 
b7C 


b6e 
b7C¢ 


AX 196A-633 5 
USER COMPANY AMOUNT MONTHS 
. b6 
[| i Raytheon $5.00 September b7c 
AHSC $4,00 August, September 
$9.00 
es $4.50 August, September 
. b6 
RADA $0.12 September Lae 
[ Raytheon $1.00 September 
$5.68 


b6 

a Raytheon $109.00 September b7c 
. b6 

[| Raytheon $41.00 September b7c 


[ Raytheon $107.00 September rae 


° ° . . . . . . ° ° ° . . . ° e ° . . . o 


[ Raytheon $76.00 September me 
° ° e ° o ° e e ° . . e . ° ° ° e e ° . . e ° b7c 
[ CBOT $0.29 September bé 
. b7C 
RADA $85,00 August, September 
$85.29 


FD-302 (Rev. 3-10-82) 


FEDERAL BUREAU OF INVESTIGATION 


i Date of transcription 1/3 1/8 4 


On January 24, 1984, 


Cd bé 
[___—+i|:«GTE Telemail, forwarded copies of the attached Telemail b7c 
messages. 


Review of the messages indicates that contact with 
GTE Telemail was made by a group using the name "Pha ad 


"Members of ro soon stated they could be called 


: ; b6 
, Ox This person then began using an intermediary 44, 
to deliver the messages. 


b7D 
b6 
b7Cc 
b7D 
In the series of messages attached,[ _—_—jadmits b6 
to frequent and pervasive intrusion into the Telemail system, b7c 
and also admits to reading the internal messages of legitimate 
users of Telemail. (Specifically, AT & T Long Lines.) 
Investigation on 1/25/84 a, Alexandria, Virginia rie « Alexandria 196A-633 
Sub E 
by SA [ sfk Oate dictated _ ly 25/ 84 b6 
b7Cc 
This document contains neither recommendations nor conclusions of the FBI. it is the property of the FBI and is loaned to your agency; 
it and its contents are not to pe distributed outside your agency. 
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AX 196A-633 - ATTACHMENT 
Sub E ee 


Ney 7. $2SP Fai Be EST Meet LSIT-3 


xz 
Jy 
- 
tG 

4 
in 
yt 


SPECPENTLY: THER 


EY UNGLIT HOE TZ EE 


ra a 


cs b7¢c 


os ss ro ee a rs e See toe ue sedate pein: ° - -- ‘Son iee ca yeh anes 
‘ : te wae BS ane Se = ss A wey 
- a pe ts oi ape aie seth 5 7 2 FOS ss tel a 
ee ae ry ee i i Se ew 
2 . ieee arr eee pa 7 
i Ay a i Para caleng ee eA 
¢ { : _ eee rer ae 
re 
Lo 


MATHEMALLY WE CANNOT 2PEAr FOR CTYEE GAPS 
FHALS WE FEEL THAT ‘ROME OF DUR MEMBERS 


“D LIKE A CHAaNCS TO DLs THI, 


: ‘ 
FLEGTE DO NOT BLO GTCELS TO THIET ACCOUNT So WE SINCERELY WANT TO EETSELITH 


MEAN INGFUL IMMUN Di A Ces 


n 
3 
10 
th 
“ 
ie) 


-20 


DAHL FS? 


PAHSL0¢F 


ECF ! 
?dumbemct 


tor tagt 

Se eg? al 

tvs 
aay tone = a 
ae is 


4520 
S441 
4245 
£454 
4Eo2 
S34F 
4SB4E 


420 


~~ 


SV4F Seas 
ZOE4G SSS 


4FR5 


S250 


4740. 
4554 


1 
a 
‘ 
a 
‘+ 
4 
4 
a 
1 
+ 


a1 8 
= Te 3 
Re 
ag ike 
ee 
Seas 
yon 
beter tae 
47a 
a0 85 
Tye 
paeie betee 
4420 


2054 
45.52 
ATES 
4045, 
4F57 
204i 
4cse 
ZO4aY 
S420 

S4i 
4345 


Se | ZOQdad 


a7 1? 


Wren 
ff 


Sone & b 


i 
noe 
! 


me 
S445 
meh 
4e54 
TEOU 


co” cy 


bd Vat cs 


ZO4.t 
4F 20 


SaEa 


on 
4F4E 
ZE2O 
4F54 
ZO4E 
200r 
S445 
S645 
ZOER4 


OOOOWAIIGIOIIATZOLS 


ro 


rs 


baa 
44a 
4F 44. 
Arg 
S20 
2041 
avec 
4F4E 
OA7 
154 
ZOE 
4F20 


4EZO 
S245 


Sd 


mo bat 


Hse Ds 
4720 
4644 


4sac 


404i 
FES 
205% 
QF ad 
424F 


A 


fa fh 


MY oe 


hail 


S245 


40a 


F-~21 


20g 
Stes 
oy 
Tete 
ois 
nae = 
Bs Sy 
eee 
a A a 
aor es 
gues 
Aw AT 
$7 a 

= 

r 


458 


4 


vy 


i i a a a ee 


. 

Paes Tae At S 
a, Soo, * Se a - 
eatery css Pa 

eof e es @ * a 


VOTED 


TALL MY MEFick 
NO TDENTISEY Yolk 
SE eg ae eo. Se 
WES YI CAN LING 
Poa TANT! 
ANS TO NESch 
MATTERS GF SLI H 
SEMALTTIVGITY. SALT 
HSMP ONE of Dane 
T NCW, AND (F 
YouUR MOTIVES ARE 
TRULY NONMAL Tic] 
cuts, Jo os ewolar € 
XFECT THAT Yat WwW 
ILL HAVE NO RELL 
CTANCE TO COMPLY 


wok 


wR OR RK RE OR 


SEOD OAOL OAS 40414. 5544 4941 204s 455 *@ ices pe > 
5254 4F4E oOno0a rd # CIN. st 


Enter SMN ar SOR? to stort xeid-15S582-2717, detail 


SMNi XGIM-tias-a71% 
Pusted date: Novem 
Delivery ttptrens: OOOOOOOOOOOOGO0IG 


Field Type ftiffset Lenath 
Fer stem { O 2: 
Tr : ‘S x 
my r) ary 
es - aon 
DAs te i a 
wi ‘ Tete 
ce ee oa L wl 
foam, i 7 
ae 
S454 S477 PITA SOT a TTT ey a 
ra 
BEA BR AA. EYE Y get eo Peep a - 
7~— . 
ey and am ar — a _ fy -~ o- 
QA A Ar Bote ay eed 


try; 
MED 
OCIE GPa Bak ee ey rhe 
Ooo 4nd . 
~ eae 7 ~~ + - . oa 
for sewer, ar ' 
a not “44 - + 
i : it rom 
> ‘yor koe . 
hot k Miyp ts. tile eal 
~ CAR ceil oF Trou 2 
AMG VEr Lo ree il. 
& would Libre te on 


8 


41001 OAC4a 4&7 7S BEEN ave 3..d1lainays 


ZO7% GEFS 4F 20 7A with cog. Ta th * 
GE464 Da Teen BOL at oend. T have 2 # 
ALA DOG AR 7R Dre leesal maidlhess 3 & 
et uP far yeu... + 
nder the mame "FE # 


mreienmdo". The fF 
aasweornd for ths 
bro as the siena 
aff vou. .ucsed wh 
en cvau cantacted 
& 
1 


xm 


JUAF 70D OATS TBAT 
AP 7S SOG AFAE 74A1 
2040 732 E04 4F75 7274 4FSE SEDO BA4as 
4173 646544 2oO7S 7OF 6éEZO 7FVAF FE7Z BOAT 
4574 7445 722m 204% 7420 72465 4540 7220 
79SF 7500 OA7Z 6570 7265 7268 6674 BO41 
2047 726F S70 ZE20 ZO4Y 20644 AFAR 2774 
2060 494E 6420 7441 6C4B 69746 4720 744F 


F-22 


b6 
b7C 
aséed vran voaur 
etter, ait seems 
vou. .represent a 
arouRr, I danvt 
mind talkina tau 


i i a 


ek Rk KR ROK eR HH 


6BAS 2062 G172 E52Qg 4F4S 2044 
649 641 7469 2074 62465 
7277 GF72 G420 744F 2079 4F7S 
4F75 7OZ0 6065 4042 4572 TELE 


S241 
&EI96E 
ZOGE 
74AGF 
TRAIL 
OTE 
POA 
ZEOU 
77A1 
4472 


mh 


TAGS 
PALF 
4620 
BOGS 
4420 7EG1L 
A744 AAI 
4A04F F7OLZO ALE 
OBOT ORS 
7EAG ZO7S 
AFATLI ravyt 
Ghee OLGA 


4572 2074 
2074 
TIGE 
éC41 


4541 4620 
E044 45274 
OEE 


LEY 


6572 ODOA 
GURY 
mae 
SRAM 


4 


Enter 
loaart 


207 NUIV fs, 


TISCONNED TET: a Tey 


ae 77 PPA 
sae gies A SOE Tey a rs 
Ar EOL 


to ee 


SONNEM TED 


Pastuard invalid. 


r eo ae) 
Jaroy 


TELEMAIL! 


Tact access was 


Liser name? 
Fasswerd’ 


Welcome te 

‘y mae: Mor Wars N maw 

CHECHE these 
TELENET 


bulletin tearde: 


From 


lommanid © 


iser’s catalog. 


Cammand?’ Ss all 
Noathine faund in bulletin board, 


Command? 5s puraed 


6973 
2070 
72E0 
OLTIOA 
4745 
416% 
T4aaed 
477d 


F-23 


wii (eT vou... CA 


TEES QM care af disce 
4173 Anatinea the pas 


sword to vour ar 
WUP MEMOS. wee 
Rather than aet 
into the detariis 
ofowenr letter 
tea I 
it 
unmtj) 
VoeleoP a 
eee ee Lh ine 
ward te 


erm 


* 


que 
rather. .wait 
we car de 

dialeoanrs 
fer 


hear pans 


Row RO Ck mR eR Kk Ok 


SH gs er yeah 


% 


PSE des 


ee]; dé, AQ Te ty 


Subject 


Equirment Fictup 


a a a a a 


* 


uF 


b6 
b7c 


Lines 


WE CAN NOT GET INTO 
GHOVICE. 


PHAL SE 


Cammand~ 


THE ACCOUNT, 


PLEASE 


SNe Meat RGIN-1591-3545 


tasted? Fri New 28, 193” a: 
=p ons FH, PHRASE S/S AS 


b6 
b7C 


seabed? TOMMUMLTAt vers 


eace excuse the delay in respandina tra vou, hewever thines have teen 
hear Rectie Jateli. We do rope veo undsaretand, ) 


“hark cre For reerandine and tar settine we a special eecmumt Fer ie, 
sdmvttediy: wf ¢sems aA hy t stranes te actyuall. have a "leeal" account 
mo ofhype eve tam, We fees that all parties invelved will mabe the moet 
ee fhe satis, 

Se ten da Tatas wre te be camedeteal- haneet mith ve cancernina thre 
rveuePrPrvaarwrwesn, (hje dere & actual dy wepeaer th cyt to hes htt eo pm frAina 
cranes, bie ord) athaemetr re wo a5 mpen and ac hamee tT Ae ue ence zt | 

oa PF eaarotye sa nite Ree pep hae arm fhe se erom, Gir pieqges mony ft apa t 


oof fey sad rhe rarer phy ee mp Mor ayer Jaet memnanr te ym. tha orecc, 


ost Rar Meng 2a oT, jher se Nas Peary eat ip eis tom moth enolic r tee conc arrina 
TR prt teh Srp te apm Ff mee pecrpo ple BANE Fa com map, Phim ae ree 
Se ara PR Re ag Mae ne Wyse swar hentia mem Te 25°, The faaect, Mafia ree 


ior eros ryt 2rd 2 sre Ser apa fey rat a eo ee i ek a 
Be OT Ree ter Matec ate OF Tea pr oer veered. are, Preys FL bh BOAT La Pe wer, 
ie GR OR roe ESE Mee SE OS Aes RE ee re a oc mat net eee fe 
Mate a te a eres a ttt Tee oe atest PEE p Vee Tania ree? Too Ferry Tyardes 
toes bas ae : eer scr ina ee ba rr ae Pes er TO i pape Tah ae reer 
Sea! Be LR ye ee irs Soya A meen moe Spore avennre taep heer 
per sae Br Ted res te cay ruet mmhar es anima te NAPE cp 
Pseeey a or a a JLo er Tima, Pa ee 17 
if 
aterm amr TP ae we © Tay Tt “st met Parma werd erimaryiy for the pupeces i 
ce mr ea yea int piles ather gyetem, sauen “ewtpaceurrieytar™ Fi 
a ee ne me terrernermnennennsimn testers A an iG 
BGR a Ree One GbR ind o Papraont af 3 Seri 
aS i rime ar. reyooard, ine athar minaty-rtive pepesnt ! 


oo) lee .toimates cameuitar wee, 


COP pam ae Dott far etea |] eat emarmt . (kas eh cen ot ol ee 22 2 oe 2 on a i 
(tee timate bom ledee far Braest, Me trom hackar anaet treat omer ft 
wb thm smh na oman TRA QT omman oem ym mad | 


Cop apeaat os eoe the unt inyehaed cameutfer ereerame That sre meedad er 


same loso t rlageee and yohe We ve eared perarre up ane earean wn was 


wpa hona as omovel frhesuan Ao waed praceecap -- a Perean the Mad matnins 
sto all ote dno with ans of thie matter -- and ys new liviese in virtual 
cecpenden animation. There are many ather euch cases, but the Point 


n2¢ heen made. 


uae FRET, @FTICIENt, and canventent (in tact. we feel wt Ss aA Potential 
anddminge for individual computer cwners as well as corperatians). 
Seaaing we dan ot kneaw what ather people were actually doing, MAT awer 
rt wes, theueh, it could certainty have heen curtarled via a Few emal) 
Precautions an yaur part. We would te more than happy to advise cy om 
these and on the workinas af yvaur srstem in seneral, however, we reall 
must know if there is any chance ot equipment heing ceturned in the future. 


TELEMATL wae net an end in iteel& ta us, We comely weed it becauce at ld 
i 


Please advice and forward thie to all interested parties. 


Yours, 


The membere of FHAISE F-25 


Paeted? Sum Nov 27, 19383 12:55 PM EST ttreent Ms@t PHSO-tS91-397'3 


ES Tr: va Lae + . 2 eS aoe caret Sie 


ote ooms PH. PHRASES / ASSO IATES b6 
vi rd , @ b7c 


sub Gs OOPS 

1 

i ; - . 
s® Should have sent the main message as URGENT with a RECFIFT, hrmever. 
“% @anfed, sa this ane will have the rereipt, The follawina messaas 


the uraent one. 


Sent at the reauest of PHALSE od a CGive mr reearde 


ar) ‘ eee d) 
b7C 


Yrures 
(memnmor af FRO oe) 


~etadi tne Mey 7. [eas trai Sm £27 Meas LW ET RPS] a we 

room FH. PHRASES SA nL TATE S b6 
as b7Cc 
copead Tmterosa | meme 


ovr toa dy 
or manera Manny rmawy 


SUIMMOUIRPT IO GT Tety FRM Hach ORet cei ro 


(2 hye feet “SS Otin cummin roa rie yo YOU Pea lt i nl fs ee =) fr a en ed 
adie i eee a Ea a a a ce Coney 
wate DEE re. Sead a i ote ess nd Mery Oe tf. eT et merit 
ne Lo mye Ma Lp ra ae ea) jor. rir 
ee ne reo mot ~ if anew oe messes throat iettose 
| a4 Soa pee or TST, eh, part ree mae 
vine dt at Tetenet how the commonverations wy th me care yed ot (),e@., Aa 
Camm tte pauceunea of an patty pteal acas To oamart cmp advises 
wor pe 
echurd? San he Prat Gyan Meas Wisp Pie Siete we foe 
cone Reeth TRATES 
a 
rhs Trivtral rpseeanncs fre aers b6 


b7C 


“y [iragt Rkeeparee to PHATE 


ey request honesty in our cammunications. IT am alad tm offer it, 
-epecially if IT can evrsct it from you, Hrwever, very Tattle, if anrvthine: 
can be said about any investigations. ‘We will do nethinea tea jenpardize 
murrent ar future investiaatians. 


T don’t knew Lf TELEMAIL is a goldmine, as vou sussest in vour letters but 
1t is a business, AS Such, we expect the users of the system will only he 
these individuals authorized hy Telenet. Yau mentian that a few small 
Precautions on our part could curtail unauthorized intrusions. Please 
comment further an this, as I suspect you are quite expert an the taPic. 
Yau alsa Print aut the usefulness of the system to business and personal 
computer users, The current uses of the system hr cur customers are aliready 
Flo, 


e 


site varied, but I would Y=» appreciate your commen @ on this topic. 


veowy call for the return of equipment, citinea it js antiv used five Percent a+ 
The time for unauthorized treaking and enterina. First, how wtten da 
“oRalare” tants, suns and tombe have ta te used before ther are cansidered 
‘angerous? Is there any dirrerence between turgslars: tools and computer 
ayipment, when the equipment is used to break and enter inte a Privates 
systems Setaond, IT wonder how manr individuals use there equipement erimarils+ 
cor hackine activities?’ The challeness of hackine are often found efeeubhere 
Nah Wein@e a computer tar mare useful @presstams of treatyuvity, as [om tures 
cr are aulare, Imagine what mrant have been accamplyshed jf all af the time 
edoatility ¢Pent om Mackinas had meen channelled inte caometnina mace 
eneteuctive. 
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(name taken the novel 


Sounds like the FHALSeErs want ta hele! HA HA 


Semehows YF eet the feeling that EB.HARDY really doesn’t think that 
ther did anvthina wrana.... (the old hacker rationale...) : 

I wish there was some way ta get across ta mim that hea was complete) © 
wrenma in bis (and his friends) Behavior... . Gh wells... 


Leoeke Tibe there were ceverai ganas Jonse am here. To car aeftire 


mast mp them, 


ae The Cracker and tris frpends from levine: Oa. 
es [bt comeans, 
é The fowgro ftom gReitary aed oe : 
4, Treas Tamer Circia : Pe 
b7C 
and uthar et 
=e eee a Sette! 
fot Hardy 
Lo 
oarat there 
be : Saree : : “pyc 


rm Sehr y tells me Thad ee wicke ge G 
2 .3e taibines ta tne Fee Bote 
= that im mic jietter, Re Beate ee. © 
leak Mere. eee 
Pououwld sure libe same direction fram wre ates to eee ge bor nr 
er { do Poe bapa t pMAm uN syns 4 at ¢ 
Septet. Monmee teri dy. ms pes - 
Sander prea, Tomiyar ca. Tr ae cy ae 
> + Tse? Tae 74 4 aby ee ia -Aatt tat Pi 
Pe 2.6 interesting hearina all torts of tidbits from FLRGUT € atnut 
what wernt oon insides TELFEMATL.  Lanke Pibe way bas Seip bat oe Pe re 
blisey Whew ! My concern ye that the investigation will eras, ani can. 


and drag, etc. and ane momentum that will mele cisceuraas futur. 
wr 1s that Funiechment eh) 
37) bteina fair, The jionaar 


evyetem hackers will te last. Meoomtwrn te da 
‘be as swift and sure at Fossitblie while ft 
you Make these poop hackers wait for some gart af indictment, th: 

mace P.eo.ed ther will get. Neu the teenagers am the other hang 

will lose their fear and want to beain Kachina all over again.... 

There needs ta be same sart of national clearin= hauee for deatira 

with cemputer fraud and teiecommunications atuse that is fundec bes 

a canmseartium of all] teiephone campanies and data communcatiane vaArrvers. 
The kind of abuse that Io am daily ain cantact with is mind hoealioas. 

Tf it is any cansalatian, he trials and triteurlatians of TELEMGTiL 

are mathing compared ta what is still) haprpeninga on other svetems 

every dav! 


(Well I will aet down of Ff my snapbhax and aet tack ta work.... 
Sorry about the cutburst, but I have ta get same of Ioad aff 
mr mind ta keep mr sanitr in this incredible mess.) 
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Bape SOE 
Ferme many bachere, the ionitial disceversy wf TELEMNSILU’© infamous "St 
derauj}t easseord came br werd of mouth. For others, it wee discovered 
bro accident. Un came occasions, was actually revealed ter TELERMATIL 
BRaminiretratere wba unwittinely sent messaeve ta cach other, met knowing 


ther wore being averhe 


rd. 


In whatever wav it was discevered, fhe fact cemainedt Rte made 
a very cerious blunder br establishing a standard default for en many 
re, It simpiy was mat realistic to expect each and ever company 
the reepongibilityv ef chansine them. One of these subscribers 
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nt 
Pascwords, 
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L-ry 
== 


But 
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had prevented furthers breaking, 
could be done regarding intrudere that had 
or never used accounts. What’s more, 
advice and changed their Password, 
eriginal auners who thes herped- 
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t ot 
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seldam 


would try once» fail -2@.. in, mutter something Dintarnre about computers 
and their creators, and then go back to his trpewriter. 


Mast af the TELEMAIL hackers did nat do anrthing malicious. However, 
we did hear reperts af same People wha sent silly messages ar tried te 
start fights among ledgitimate users. FHALSE people were especially 
concerned about this, since everranee’s "Safety" an the svstem was 
being campromised. When the crackdown came as it undoubtedly would, 
all of the hackers would be deemed as tad as the verrv worst. And so 
1t went. 

ebtain as well, 


Administrator accaunts epraved ta be rather eacr ta 


either the same "A" gderault or same mathematical eauation involving 
the user ID number (a special code beginning with a "#") would spell 
out the Pacsweord. Naturally: we were verv concerned when the above 
Peaple began bragging anout getting ints these accounts. We bnew they 
wouddgn tt tare the Froper erecautions and would wind ur Chewever unwittinel +) 
Causing jJamase. They were warned repeatedi¢r not to Play 4arcund where 
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they might tbe noticed, and not 
attention (FP. PHRERAK, HACKER, » ade 
would be followed ¢2 the lerters, out at 
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co create names that weuid attract 
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the mameznt, we 
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Eyers Cime a mew accaunt was entered, more information was Pee, 
For gwampie, let’s sav we sust get inte an actaert weed ts 

We could mow do a ULERT OF NASA and set more names than rr we vid 

it trem anether moneNATA account. The setinrse ttructure af TEL OMSTL 


wass thus, bpeceming unraveled right betere cur eevee. 


Neo matter where we ended up, theoushs there was aluayve rrivate data- 
which we could mot see, And it was’ ear te fisure cut heu to get this, 
although mot very practical. A sPetia) wser ID cles cad been aff bened 
to gach user IT, It teean with a "#" and was shown with every EIR 
readaut. It, instead of the user ID, vou entered the user TT code 

the same information would be displaved. All that would have ta be 


done te set a list of #everrvbody® would te te keerp feeding cut different 
user ID codes (either sequentially on randomls) after the DIR command. 
This was much easier than trying to guess names. A computer ceuld 
do it willingly. But it still would have taken a very Tans time, if 
we had ever decided ta really Pursue this. We were never able te find 
out whether a wildeard format might work here (GIR #°A*° or DIR #7"), 
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In a future message, .@.,, tall about what we ee daeins 

on the system. For now, thoush, we would like te Point out that we 

Teck on this whole mission af discavery ae an Adventure. We were more 
interested in ¢¢eing how many acceunts *eould= be attained throuseh 

vVarigue companies than we were in actually obtaining trem. For mma thar, 
there was oe meed for us to attain new aecaunte, fines we had enough /i 
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Posted? Fri dan 13, 1984. 3219 AM EST Mss! AGIE-1597-a728 
From. PH. PHRASES/ASSOCIATES b6 
Tas b7Cc 
Sut! AN EXPLANATICN 


Hello, : 


As vou've eProtatly noticed, cammunicatians have deterirorated. This mas nat 
heen intentianal. Events have transpired toa drastically cut tack access te this 
system. Here is a trief explanation. 


This is anmly the secand time that I (Manny) have communicated with row directive: 
Metare This. To weutd dictate mr messages over the Shane ta camenne uirth a 


terminai wha would then cend them tea wau. 


wecentiv I arscavered that this Persam was really an FHI wnformant. "hin 

ror a time, F wasn’t sure unmether or mat the messages Mad been sent or even r+ 
the aAccaunt e™isted. ‘So tor the Past tum weeks, [ ve been ecrimping and 
favine te get ahald-at a terminal. That accomplished, Io cam now resume 
COommMmuMpeatians. 


There have heen a lot of rmasty side-effects caused by thie latest reveiation, 
however. For ane things my REGL mame and unireted enone niumoer ars beina 


rheawn allo over the country, which 1s a tit a+ aA tether. dtoweulan t 
Sureepseea me At ald re van Aire@agy nad them, fro oalenu cyedetn S Fur ee ite me 
(fovea were actualls, Part wr the FR] coupe@eie far tetveci, TP Sop 
eeseirgbrlities den’ t upset me, alitrouean Do dn appreciates homeet. curnen 


S$iscussinae such thines, 

what dees upset me, thouen, is the wav in which this entire thine is 
IOLA. APart fram the threatening calls I get on am almost Jariv basis, 
friends aft mine are teina harassed because ther know me, To geno t brew 
.F this is the usual FRI routine, but it seems a bit much for wnat 
wevre talkine about. 

Sar same reason, PHOLTE is considered ty them to be some huse and 
tangerous ore@anization. LT dan’ t know hew they interpreted the messages 
“hey read, tut from what Io knows, mothine could be further fram the 
“ruth. PHAL'TE 16 actually more of a etate ar mind than an actual 

rmeup, but fT certainly don’t want to bore row with mr anterereration, 


would appreciate any suggestions ofr revealing statements rou misht ; 
Nave at this point. Also, from now ons I will te speaking Primarily from ; 
mY owt Point of view instead of claiming to represent the "“9sraue", Tx oe 
continue to do that might spread the wronea idea even turcther. 


Again, thanks for sendina the copies at the messages sa readily. 

They were a ereat help. JTF I’m mot mistaken, thauah, youre missing 
une after vour autbaund #3. I seem toa recall a message that said 
semethina ta the etfect af "this has teen the most canstructive message 
so far," As lana as you remember it, ‘that’s fine. 


There are twa more topics [at teast] that I had Planned ta address (pre- 
ventative measures for vou & an explanation of what we were doing on 

the system). I’m hoping for later aon today for at least ane of thase. 
PuUrPaASe of this message was to let rau know EXATTLY whats haprenings 

on this end and to try and explain the spettiness of our communicatians. 
Hopefully, I°11] be able to finish these messages before I get an 
invitation ta Alexandria, which I’m tald could come at any mament. /| 


Lookine forward to vour replys FP 43 


— @ ® 


P.S, I’m usinae 300-424-9494, Is that Qk? 
PLP.5S. Did vou get "24600" vet? 


Peetedt Fri dan 12, 1924 1241 PM EST Ms 


as UGIE-1577~-470% 
“roms H.PHRAISE'S/AS SUI IATED 
Tas 
mins 
Sut? My viewPoint 


First, a couple eoints related toa veur message, I really am not auite 
sure of wha yeu are (Call that matters 16 vour @e#Perience -— which is 
“vident by ceur Previcus messages - Nat vour mame). I dan’ t fave rour 
anane number, and would never call vay (Clet alone maracs vou). [ can 


ASSUPE oN ne one froam Telenet wauld call owoau. ABs ear as vour AaAllesatians 


amnaut the FEI, [ personally have a2 gead deal of respect for all taw 
“rfercement agencies; it is my opinion that they have a fteueh got on 
JTetayv: s enciety, tut Iove never heen on veur current side of the fence. 
Poaminot with the FRI, I have worted far OTE ror a number af vearss and 
am verv involved with the Teiemarl eraduct - of which [ am very Praud ane 
eretatly even a little epratective ar detensive, 
janted 9 Mave aA dialosaye with voy erimarily eor the menerit of Telemadai 
ned the anduetry in aeneral, You Nave heen invedved yuith the current 
fenneboe@1es and LT am anite interested ino vaur persPective. Hew viebrer ate 
are teday’s systems (naturally Io am nat witheut an epiniond,s hou would 

a a tbe best Bravented, €tec. loam mat trvana tea Play 
tricks with vou -— honest Actually, TIT am verv appreciative of your time 
and effort and feel you have a auad deal of valuatle input - if vou are 
$0 mativated. The way I have aperaacthed cur relaticnship is that if way 
are Playvina tricks an mes soa te at, I tried. If vou are heleinge me, I am 
onfty tao happy to passe this alone te the FRI, and martbe it misnt help me 
(naturally, IT am net in a Position te even syuagest that it might hele -- 
Sat Io weuld like to thank it dees). 


Foam glad that vou are not vseine an intermediary. That was vour call, and 
[om sereyv ove think ot didn fo wark wut far vou, else, Tf Fave mot received 
2 tTepy af "T400", bot weuld really like ta Caf seurese vou can t compare 
she mail ta Telemail im terms af speed). 


Thanks for yvour help. IThiepe we cam reaily get ante it. 


p= 


Pested? Fri an 13, 1924 2i31 PM EST . Msei LOIE-15°7-4241 
=rome PH. PHRASES /ASSOCTIATES 

Teas 

Sates $ RE: My viewpoint 


I believe in yrour intesrity and sincerity. I wasn’t impelyine that I didn’ 
trust vou -- I was simply trying to point aut how difficult it’s become ta 
trust ANYBODY. That’s ane thine I’ve learned from this whole thina. Ary 
time you sav aor do somethings it’s always passible that there”’s sameboady 
takina nate af it. Until recently,» I would have thousht such a statement 
indicative of a Paranoid, but now I’m not so sure. 


I dan’t know if vou realize or desire this -- but since my intermediary 
turned out to be an informant, that means every word that’s Passed between 
us has been looked at by many others. Now I dan’t have any problem with 
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this» out £ tneusnt vou should knows 1 case vou didnt already. Like 

I’ve said before, I’m ve distressed by that revela@n mest of all because 
that person was tryins ta wget me te do all kinds of thingss on all kinds of 
systems. Fortunately, I didnt take him ue an that offer. 


Anvway, enguah of this? Ill start working on the next real message now. 


Manny 

Peeted?: Sun Jan 15, 1924 4:59 FM EST Mse: AGIE-1S97-S746 

Froms PH. FPHRASES/AS SIC IATES 

Tas b6 
mits ' b7c 
Suter: GETTING RID OF HACKERS 


What can te done to eliminate hackers aon the Telemail system? Realistically, 
Very little. Telemar) is a huge system and mat all of the certitied users can 
be evpectedq ta follow the came strict auidelines far protection, or even ta 
noderetand them, Hacters thrive an this sart af attitudes, an attitude that 
wer * onanee until the average user is insected with a laittle “hacrer 
mantairty’ himself... "Unce samecady sees what their weak Points are and maw 
Theee Can Fe used Against them, their protection will necome mare ettective. 
“Eye amples rpenetrating a hacker’ © account wouid be much more FALFficuit thare 
venearrarina an average accaunt., Most hackers Pnow how and where to protect 
‘PemSe@ivesc because they hoow mow their own Minds work. Syvetem cPerators are 
mre e@nesecs this same enresiants, and many times they eatain rt theauarn 


BO pra ss rPertence, ] 
pune TMG vastoess of Tejemail will never toraily disailew hackheres the Primary 
a toarove tr ghee Ge to limit the twamage ther can wa Caccidentally ur intentional] 

Mete they are inside. Risnt tous LF © were To Sain access TU AM acceunts ff 

vudop omer ani ¢ee@ allo mf the mames that I tan send ta, but theusands that 
Tannen send to, T* I cannot ¢cend to theece RPeaples why should I even know 


exist’ With this kand of a system, I can get a hardcopy printout and ¢pend 
‘awe Soins dawn the list tindinea deraults (or, now, Findine inactive accounts 
‘hat mever changed their deraults) or fairst-name ar even user-name Passwords. 
Ath acm account penetrated, more mames cowid te found. As I"ve mentioned 

1 Pravinus messages, there are other ways tao get names usinea tdentity codes, 


Prowece That shouldn't te allewed. 


‘dminisztrator accounts will be eenetrated in the future. Not as often as in 
@ ener, Perhaps, but rt will happen, Maguor cammands -~- deéeletina ar addina 
“Sers -- sneuld be sutsyect tao veritictation berare they're acted upon, perhaps ty 
qaeneratina a message ta the aaministrator: s real-name account, advisina himsher 
“fo what re about ta te done. (On this sunsvect, I"ve heard reports cancernina 
how all oof thase NASA users get deleted. SsuPpepasediv, ai hacker was Plavina wath 
one of the administrator commands and theusnt he would eliminate the termination 
dates. So, when he was asked for the termination date, he hit a return, 
thinking that that would leave it apen. Instead, it made the termination 

date NOW and Promptly eliminated all of the users in question. I can’t contirm 
this ~-- administrator functians aren’t my speciality -- but 1f it is true, it 
indicates a significant Protolem with this caommand, t.e. the same command 

can tbe made accidentally ty a lesitimate administrator. } 


I’m not sure what the criteria is for allowing use of the SET command, tut it 
cam be used ta cover up one of the best pratective devices currently an 
Telemail, namely the last access date. This tells a Persan if someane else 
has been using his account. However, it can be suppressed using the SET 
command. @ naive or inexperienced user misht nat netice or think that samethings 
is wrong with the system when he doesn’t see the last access displayed. I don’t | 
see any positive application of this suppression’: it’s only one line in the 
first place. 
F-45 


Users should know if Somegpe is trvinge to set inta thgmr account. If sameane 
tries, say» nine times t ter a password fer a par Pular user id, a message 
should tbe sent to the users informing him of this, perhaps even letting him 
know what passwords were tried, in case the hacker is getting close. At the 
Same time, the accaunt should lock itself for a periad of time, sa that the 
hacker can’t eventually suess right and it should re-lack itself if future 
attempts are made. But the hacker shouldnt te tald that he’s locked aut, 
most importantiv tecause such a message would confirm that he had a 

correct user id. , 


I’m sure there 1s more an this subject that I wanted toa address, tut I have ta 
be samewnere else mow, [“}1 devote same thoveht to anvthaina else I want to add, 
and hopetully I“ 1] get ta that late tonight. Fleace let me know 1f vou have 
any s@uestians om the atove or tapics vou'd like me ta ga aver. 


By the wavs Iom maw usine my semic-local access number, as reauested, 


Marty 

Fasted?: Man Jam 14, 1964 Fiy7 4m EST Mesa: LGIE-LS"7-S572 

Frame PH PHRASE / GIR ITATES 

-_, ; b6 
nos b7C 
upteg t SOMETHING ELTE 
(Thane fer the camplimane, : 

c 

oe BPI L Tima Prem leet Cate ho tinal. mokono tler on rhe Telemarl srstem 

Teac ge methine then t oer 4-4 Nech er 2 oipeam 1s The Unread cammand. [ had 

treuple helievins that ane autem Po first came across it. It was actually 

eess .0)e th PeaAd somened, = mad And then reseal the envelope, witheut 

(e4vine GNY traces! Porsalt nave te think hard to find an over-the-counter 

te For that command, Lo suce theese must be same Purpose tao it, but the 

mriecuse of the Linread function, tm my opinions negates that consideratl +. 

. . / 

Todon t want yeu te @et the wrene idea. Neither Iomar the people To come ). 
runmicated with spent a great geal oof time reading other people’ s mail. Yes, os 
‘Se did rt a couple laf times, utes we suspected that rt miasnt nave heen A, 
-vallw interesting (Libe with AT%7 Lene Lanes (ATT.LL) and their _elever 
saecwara of PELL -- can ney Clams 4€") put ror the mret part we stayed auf 

op onther peaple s afeairs Mora an that later. 


sanmnat tom trying te say tt tnar wf anvane really nasty and malicious gat ante 


itd ' 
¢ closest frienmas. Thats. comtined with the SET functian I descrited 
rlier could very eftrentively caver his tracks. 


One more thine! a motice of some sort when there is more than ane user in an 
account should tbe sericusly considered, There could tbe fifty PeaPple in my 


account right now and Id never find out about them. 


If I think of anything else, I°l!i pass it alana. 


Manny 

Posted: Mon Jan 16, 1984 3:54 AM EST Msat EGIE-1597-5874 

=rams PH. PHRASES/ASSOCIATES bé 
Tot 

¢ b7C 


Ce 


In the lishter side, there are all kinds of interesting commands 
and features on this system. Some of which yvau mar or may not be 
aware of. Odds ar most people don’t know about this one. 
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eee Exception: This errogrevrs not oecur. @ 
909 172 BISCONNECTED 00 20 00:00: 20:18 43 96 


ec 909173 


9097 173 CONNECTEL , 
Password? 
Welocame ta TELEMATL'! 


Your bast access was Monday, dan 14, Lva4 2734 AM 
Nea crew mail. 


Tammand? RECUME 


ie 


Tt’< a Pretty intereeting feature ayverajl: T learned it fram semebade an 
"he syetem (A Macher, af courses, Tocteem @ reg ily ¢ee% 3 Spence fa it, 
PMOGPT to crests practical oobe¢ ant teoare menple te Geatr, Prob preeoai} 
torpcectivs we did uss ph ote syciee eras Toa Son Away fome rarher 
Lmevrperprenceaq acters, Lt was ar nd » lL bei iwyver. 

ATTENTION HACRER. T - 

M405 

1S THE FRI AND WE HAV 

c 


TRACED YOUR TALL. 


They haven't stepped an any sidewalk cracte ince thems, J hear. 
X 


n 


Ivll send same more seridaus sturt either late toenmiranht of tamarrecaw, 


“acted: : i 13, pred 11:44 FM EST Meat MATE 1a vs la 7s 
Seams PH PHAR LE SAAT TATE: 
7a RECEIPT) 


Sut & A FROBLEM WITH GUR COMMUNICATION 
Hellas 


As vou know, I sent rou a message a feu days age explainina why cur 
communicatians had been temporarily cut off. In that message [ told you 
that I was usina a se-between whe later turned out to be an FRI intormant. 
I also made reference ta the fact that I was teina harassed and that I 
believed this informant was at least partly responsitle., 


Recently a message from this person was forwarded ta me. In its he 
vehementy denied those passibilities. Now then,» simce I have heen careful 
not to talk with anvone else concernina this, I can anly assume that he 
somehow read my message. 


There are a few possibilities tere. OGne is that the FBI is manitorina 
your system without vour knowledge, in which case I feel an obligation to 


: : FL47 
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tel) you about it. Anoth Possibility is that ther® monitorina my 
which doesn’t involve vou all. Or perhaps youre Wiowins these 
communications to them vourself. 


As I’ve said (or certainly implied) tefore, the latter possibility doesnt Uf 
upset me at all. It’s campletely within vaur riahts ta share our canversations 
with anvrone vou desires it’s your system and it’s yvour case. But think of 
this: somewhere alongs the lines no matter which of these three scenaricas 
28 true, the FEI is jlettines ane of their informants read what’s gains 


between us! 


davybe I’m aver-sensitives I think, thnuugh, that vou should be as indignant 
as JT am concerning this. That Persan 16 mot an FEI agent, and as far as 
I’m cancerned has mo business reading our mail - he 1s mot the one 
cenductina the iunvestiaatian, 


I’m really rather surprised at the FRI. I thovenht for sure thevod have 
eatie1es against this kind af thing. By doine this, ther re compremseisine 
rheir own security as well as ours ~- this Persan 16 mot te te trusted 

with anyone! Having talked persanally with him on a number of omtcasianse, 

i“ve heard a few rather interesting remarks he's made which lead me ta 
nelieve that he’s na mare an the side of the FHI than Me te sm mine. if 

think he’s taking everrtady far a drive, MF courses TO cauld never prove thie, 


Please take whatever action vou cam ta see that this unautherised eavesaropeirpe 
7S stopped, IT have nothinea against authorized eavesdropeyne, but owe ehrdid 

“eat it stop there. Pleace jet me brew vour Seelineas on tnis. 

Manny 

Pls. Did vauw eet my last message a,kl vy JT here at didnot mera up wear 

terminal ar anythins. 

Fosted: Thy wan 19%, 1994 S204 AM EST Meat FOIE-1LS 9s -75es 

Spoons PH. PHRASE S/AS SUC IATE= b6 


b7C 


tut THE OTHER GLY 


think the situatian 1 es imsidicus than vou miasht have assumed, 
The intermediary we used 18 alsa an evperienced hacker Cor ea Tf 
Le@lieve)., When he sent me 4a short message savyina that he would nat 
be an intermediary, I ortered him a place out of the rains sm tea 
-Peak, and gave tim an account om Telemall. I need all the mele f 
Tam 9et, and while I dan’t have the time or the inclination to Play 
-ay twa against each other, I cam alwars use more information atbout 
nay System and hackers. When rou told me vou theueht he was an 
informant, I told him (electronically) that he was indeed viewed in 
‘his light, and he might want to clear the air if this was not based 
in truth. (I weuld think vou weuld want this opportunitr if vou were 
in his shoes), Serry, if this caused you undue cancerm, tut I must 
admit all the possibilities vou autlined cauld have been the case. 
As far as [I krow, the FBI is not monitarina my lines. It would te 
suite difficuit technically for this ta be the case. 


I tald vou in a Previaus message that if the infarmation vou gave me } 

was helpful, I would be happy to pass this alana to the FRI (I think / 

this cannot hurt you at all). Linless I hear differently, I will hi 
t 


continue on this course. 


Please discuss this further if vou still have concerns about our 
communications. 


F-4g 


sHaNhn Ss 
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Command? 
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aE Ty 


ERA ane Phere. Cone 
meet ; ee iia 
SHOD & WirsHop 


ATTORNEYS aT Law 
53+ BROADHOLLOW Roan-CB 179 
MELVILLE, NEW YORK 11747 


RICHARD C. CAHN °S$'16: 694-2300 
EUGENE L. WiSHOD 
JOSEPH H wISHOD 


ZSUGENE RR, BARNOSKY 


CAVID R.JAMPOL 


November 7, 1983 


b6 
b7c 


-Pursuant to our conversation of Friday, November 4th, I deliver 


to you on behalf of State University of New York at Stony Brook, vari- 
ous material relating to tne computer investigation andf 7] 
which I briefly cutlined sc you by telephone. 

I would be obliged if, pursuant to our understanding, you would 
identify yourself to my secretary as Special Agent of the FBI and 
acknowledge receipt of these materials on the attached xeroxed copy 
of this letter. 


Sincerely yours, 


= b6é 
ee A bre 


RCC: bp 
Enc. . / 
HAND DELIVERED . Lh ifeg -aon 


THE ABOVE MATERIAL WAS RECEIVED 
THIS 7th DAY OF NOVEMBER, 1983 
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SNORANDUM 


Wtiee of Vice President for Adgiunptrctias 
otaie Univer ity ot New York et Stony Brave, 
Story Bi NSY*11794 


telepirone: (S16) 246-6000 


a 
MA. 


Tos 
b6 
From: Be 
Subject: FBI Search cf WUSB Offices 
Date: October 14, 1933 
Pursuant to your request, I shall attempt to provide you with a 
summary of the events of October 13, 1963. 
At ape oats ly 1 P.M., I received a phone call from 
informing me that there were several FBI ajents on camsus and presently were 
in the process = searching room 24¢ of the Student Union Euilding which was b6é 
the studio of Station “USE. He said they tad arrived on the campus 2 couple pyc 
ot hours prior to ciis time armed with a Tederal searcn warrant. He hac 
z 2 Puplic Safety cfficer, to accompany the agents. 
that he had called the President's Office es well as 
I then met with[ dia his office and requested a cory of 
“he search warrant. I eee tnat the search warrant limited the search to b6 
roam 624) of the St.uwient Union Building and asked if that was in b7C 
rac. the room they were limiting their search cto. He attempted to contecer 
StcEFors by radio .hile I was there to no avail. 
Upon_reserna to my office, If called WUEe with the intenticn of 
speaking with wic I was told was at a meeting. Enseeac, I 
snoxe with wig advised me he was a former student and voluntzer BG 
woLKing with the station. told me tnat ne had @ receiot for tre Bic 
Lcems, ‘wnach Ene. Sol (toe. and he6tghh Le. to my olticSs accontanies by tas 
ether gerclemen wii) work at the station. 
b6 
cation Said tnat the b7C 
room Is alway: zor locked and thet only the aforementioned ceonie hava 
access fo 1t. 
' He told ma they use a Heathxit H89 conputer for the puro ese oof 
Going prograsming, listing of addresses, etc. I asked if they had cone any 
programing on tne computer or hocking ints outside computers, since the 
warrant indicated that the evidence the FSI was seeking was with regard to Be 
wire fraud. told me that at times they had made connecticens with Rye 
“computer bulletin boards". understand these bulletin hoards are orerated 
by scaputer hobbyists and are used for leaving messages for private reozle 
or retrieving technical infermaticn, etc. He said the bulletin board cnone 
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ESr Search of wUSS Offices 
October 14, 19933 
Page 


numbers are available in computer literature. 


Lito? me that the agents advised him that the equipment 
waS to be taken to New York City. —— 


Jpon return to my office, I called ea Counsel's Office 
immediately and advised them of the situation. I have forwarded to them a 
copy or the search warrants aS well as the receipt “for equipment. 


On the morning of October 14th, I met witnD sidan 
an the morning of oot eee tiaetache-as tol ome 


At about 11:15 or 11:23, he was called by and 
informe? that the FHI wee at the studio to search room 242, 
askei to see identificzcion since the aqents Gid not offer cradentials 


_ 
a 


@ agents then searched room 246, finding nothing that was 
atea offered the information that we in fac 

r equipment, put it was housed in room 227. The agen nts then 
several ne calls and eventually requested permission to gain ac 
ra He qave them the authority to enter and se 
P. 


to room 227 q = ares 
that rods. cconpanied the egents @s Gigi ta let unbic 
Satety. aught a class and hed a meeting returning to the 
studis at about 3:3¢. 

hat all of the computer hardware celenas 
to an individual and tne software, discs, stationery, 
etc, 86e te property or Polity. Rocordinyly, it @podars that netning <Aat 
was taken by che FBI is actually owned hy the University. 


[espoxe with the owner of the equipment, 
and advised him that ne would do well to seek legal advice. 


a 

at the same time this search was cccurring on cenous 
home in 

as not thers at the tire WAS adyvis y nis roommate, 

mat ali computer related equiment and software were removed trom the 

remnises at ened time. did not inguire of of his 

involvement, but merely roid him to seek legal advice. suoseduent to my 
{ 


meetin with[ Jana spoke with anc 
ae -I advised both of the new turn the situation had taken in that 


Was informed that 
there was also a search 


property was not that of the University. felt that altnoudgh 
that was the case, we were still peripherally involved since it was ‘WUS3 
_ offices wich they searched. 
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SBI Search of $7US3 Offices 
October 14, 1933 
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[naa suggested, prior to learning that the equipment was 
privately owned, that|-_]telepnone the FBI and request that the 


eguipment be returned to the campus and/or we get copies of everything they 
tcok. I forwarded this suggestion to who Said he would act on 
it. 


expressed concern, aS dia[ | that neither my office 
nor University Counsel's Office was contacted by Public Safety when the 
agents first came on campus but only told several hours later. 


aiso expressed the concern that he had no prior knowledge 
of the agents arrival. He felt that a phone call from Public Safety prior 
to the agents coming into the Student Union would have eased his situaticn 


greatly. 


evpressed some concern over the role of Public Safety in 
that he felt they should be more concerned with protecting the University 
rather than assisting the law enforceztent giants of the Fel. 


RAN: jkw 


att. (2) 
l. Search warrant 
2. Receiot of items taken 


blee: LT ] 
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Sucscnsoes, ecm to, and returrec meicrs me ms care 


Date: October 17, 1983 
Re: Computer search by the F.B.I. 


At approximately 11:30 a.m. on Thursday October 13, 1983, while -in.my 
office (Stony Brook Union 271), I received an intercom message from[_| sk 


rere | that he was in the studio (Union 240) b7Cc 


and there were agents from the FBI with him and I should come right down. 


I walked into the studio and immediately identified-myself to one of the 
agents (it wasn't until about 20 minutes later that I realized the agents 
had not identified themselves to me so I asked one to do which he did). 
They were accompanied by a member of the SUSB Office of Public Safety who 


you later identified to me as[ ssp?) b6 
b7c 


Upon my arrival, they showed me a search warrant for computer related equip 
ment and miscellaneous documents whicn they believed were located at the 

radio station (Union 249). I immediately became concerned over the fact tha: 
I was certainly aware of computer equipment located on “radio station" 

eremises but net in room 240. After a few minutes of the agents searching 
the first of several rooms in our studio complex, I decided that in order 
to prevent possible disruption, interference or tampering with present or 
future broadcast studio operations I would advise the chief agent,[ | 
that the station did have access to computer equipment which was located in 

another room of the Stony Brook Union. This equipment is personally ownad 


byL__ at WUSB, and is used by the radio station 
to create and generate program logs, mailing lists and word processing docu- 


b6 
b7C 


At this time,[ sd began placing a series of phone calls in order to 
get permission to search room 227. At the same time he asked me if I had 


authorization to enter room 227 and would I sign a statement stating such, 
which I did. At approximately 12:4Np.m., the agents moved to room 227 (I 


WUSB—FM, Siate University of New York, Siony Drove, New York LiTu4 
Phone: Offce (316) 240-104), Studios 247-7501 


Fa5¢ 


ments. 


2 : | - @ 
- don't know if ame authorization to do so had been reached). 
At this time, the agents entered room 227 which I had now opened 
for them and one of them immediately began photographing the con- 
tents of the room. Since I had to go teach my THR 270 class in the 
Fine Arts Building from 12:45-2p.m., I left the agents in the presence 
off a station staff member and former|SSS—idib 
[Jana now an alumnus of Stony Brook. Eric is authorized to have 7° 
key access to room 227 as well as having knowledge of wnat ccomputer 


equipment was in the room and could verify the "checklist" of equipment 


removed. 


At the conclusion of my class, I went directly to the office of[ 


the situation. 


At our 9:30a.m. meeting on Monday October 17th, I advised you that ne 


[haa come to me with information possibly voertinent to b7C 


to the situation. In a later telephone conversation you suggested that 


you would schedule a meeting with him and other camous officials. 


Dep ( 


ox 8242 
Octcbher 19, 1983 
b6 
Orfice of University Counsel b7c 
State University of New York 
State University Plaza 
Albany, NY 12246 
- Re: FBI Computer Search 
neem , b6 


Enclosed please find a copy of escort of the events of b7c 
October 13, 1983, as well as a mention of his conversaticn with 
which occurred in Port Jefferscn on October 15, 1983. 


Cn October 18, 1933, at approximately 2P.M..[ Cid b6 
Officer, and I met with concerning additional information, — 
which he had conveved to 


es a full-time stwient at Erpire State College and is takin 


ore course on ovr campus. He is at WUSB. 
statec to_us that when the FBI agents arriv wcoght it necessary 
to advise of their presence, in that be Rew the were 


t.and though was the 
owner. Ee said he telechonsd at hare snortiy after the agents . 
acrived cn the scene, and responded, "Thanks aloitfor letting re 


know, there are things wet ve to cet rid of." (Or words to that 


interested in the corputer equi 


effect.) In iticn,[ ____ told us that is a telephcme b6 
buff, as it were, and is very knowledceable about technical asrects of b7C 
the teleonone anid all of its various ranificaticr He also stated that 

at cne tine, te,[ Was present when and a couple of 


cther young men were apcerently making a telechone call to the Persnse 
Decartment in Washington. de stated that althouch he has no technical 
knowledge of the computer, he was present when he thoucnt that[_]. 
and were apparently gaining access to same caqputer: 
cutside the University, though he did not know what or where at tha time. 


also noted that. several times during the sumer, he heard 
comment about fear of the "phone police" arriving, and b6 


‘that he inferred from these comments that they were doing something BIC 
illegal with the telephones. 

ee alumus of Stony Brook and was involved in a similar b6 

inc concerning the commuter at Catholic Umiversity of America in b7c 


Washington. I am enclosing the records, which we have an that case for 
your information and files. 
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October 19, 1983 


At the present time, we arezattempting to find cut if the telephone lines 
on campus ware used illegally or for the purpose of accessing cur om 
Univac. If that investication welds any fruit, I will keep you advised. 
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STATE UNIVERSITY OF NEW YORK 
AT STONY EROOK, NEW YORK 


Memorandum 


Aer ix Comment ane criticism: r : 
Your information aad fles © 


“am Beet ewe 


Tt men apse eee See ee 


Please note and return 


Pee 


. At your segues ees 


. 
. ee 
s Ae . : 
7 ae ra . i. = 
. 
a - b 
: ose a, - €-0 
¥ - . ba . 
* - 


ere 


~ 


aw 
MWe 
Nias i 
TO me. 
= Cts 


—ee 
— 
-- Ee 


. . ‘ 
2 _ 
. 
7 
- . 
” 
. " . 
-— = 


STATE UNIVERSITY OF NEW YORK 


- AT STONY BROOK, NEW YORK 
Memorandum 


cece ew eee’ Appropriate action . 
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TC WHOM IT MAY CONCERN: 


The following is a concise eccount of my Gsalings with the cempu 
at the Catholic University of America and the eve 2d 

r terminal was contain 
ricinel 1.ntentaon. or 
ng. However, we both 
es on WlSB-FM, the 
is reason the terminal 


-<ly Maren of this ye 
of mine. It was > 
ies homework in a S 
eventually using it for record cet 
o station which we both work on. F 
roa time-in-ovr technical office. 
ited to find out 2s much as we could about the different types 
available so that when the time finelly came to start entering 
which would be record titles and companies), we wouldn't, in effec 
ing in the dark. We found out about a local computer bulletin 
ed in Centereach, called Connection-802 Wheat @ comeuter 
rd Goes is list the access numbers of eCheneerS all eround the 
vy wWaere. one. Can Sitnes leave messages for Other .caliers or ciied 
zion about various computers. 
© access number for the computer at Catholi 
his bulletin board and prohably on many others. fT 
thing underhanded ebout this particular point, sin 
xo His bulletin board by the computer cluh at Ca 
S meant to be called. This is wnat we did, with a 
tiors Wnesesvee. We dialed into their system toe 
sain by their having the mum: 
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al connection to this comput 
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which was used in my high 
nem was the SEND commend, Ww 
ages to other users- RoWweyee, 
was a major ditserence between the two 2 ears 
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<nis means is tha the user had =o encer his -SeS0ent ner 
ere he was edie £o Go any sort of “ork, which inc 2 

nessages. Even then, he was only able to send me 

messages sent to them. Catholic University proved to be nm 

itnyone whos dialed into the system could sens mess 

eing locced on at all. 


Out ‘of curiousity, we tried to make contact with other users, to see if 
Ss really worked. Several responded, saving that they didn't want to ba 
pothered. We complied with their remuests. A_couple of others wanted to ta 
2S, including ome person whose first name was[ (or so he claimed). His 
last I couldn't remember except that it had one syllable. The reason why he 
stands ovt in my. mind is because he askea so many cuesticns. I save Sim my 
name, my major, the sehcol I went to, the talieshone numrer for the radio 
station, and all sorts of other information which I didn’t see env herm in 
giving him. At one point he asked for my nome phene number and address, 
wnich is where I Grew the line. I did, however, give him the access number 
for the ceomputer at Stony Brook, perhaos POOLisAly,, “eltncuca 2 honestly: 
2idn't see what harm he could do with“é Pessvwors Of accouns Avs ibex nt 


another voint, he suggested (since he knew chat I was 
2- radio station) that I trade him recorés fer ecceunt 
imzto his syvstem. zt the time I took this a5 a coke @ 
F-69 
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1 he 
.en responded. 

I talked to this same person the next evening (I don't remember the 
2xact Gate except that it was sometime in March) and possiblt the evening 
2fter that as well, which would have been the last time I- called to their 
system. On each occasion he asked me suestions about myself and whet I 
tid. I asked nim a few questions as well, however, in all honesty I forscot 
1is answers in a matter of hours, since I had slight ly more important thincs 
on my mind. Unzortunately, we don’t have a printer, so the communications) 

S had with this individual were lost as soon es they left the screen on the 
-erminal. 

That is the extent of my dealings with the Catholic University comsuter. 
“so bo time did I log on to their system and I certainly never offered to 
‘axe any ceais with anyone for such an opportunitv. Frankly, I woulén'+ 
mow wnat to do even if Iwas able to log on. i know very little about 
remputers and I don't have a great cesire to expand that knowledge, excert 
:-O Know what kind of a system would be good for our record catalosgues. 
ty experience in high school was minimal, to say the =3a most. 

Io reaiiy don't understand what hes been going on since I communicated 
‘ith this individual. In early May I heard from the office of our Vice- 
‘resident for Student Affairs. They told me that they had a complaint fron 
atholic University ZEREX whicn concerned me. When I first heard this, i 
"25 extremely annoved. I felt that anyone who saw harm in my few communication 
‘ith random users was extremeiyv paranoid. : 

Since tren, though, I have become more aware of the facts involved. TI 
ave spoxen with both the afore menticned vice president as well as the campus 
udicial officer and, from what they have told me, Cathclic University has 

very legitimate gripe. Someone has been communicating with users attemoting 
S obtain oasswords and other secre& information. Perheps this is not sc 
mustal: I'm not familiar with the espionage dramas that I've been told exist 
eGineg the doors of the computer room. What is unusual (at least, in this 
articular case) is that my name has surfaced as the one trying to chtain all 
£ tnis valuable information. As I mentioned before, I have no interest in 
hese thincs, and even if I did, I7don't have EX#¥ the time to devcte to it. 

What appears to me to be happening is that some inconsiderate person is 
ctempting to rob the Catholic University of its computer services and is 
sing my mame in the process. (It's obvious he/she wouldn't use their own 
ame!) In this case tne person nad previously found out all sores Of thincs 
Sout me so that they cculd be more convincing. ‘Well, they were. I haven's+ 
een the copies of the conversations that cccurred, but I’m sure I world be 
nocked to see someone use my name and personal information while attemoting 
o rip someone else off. Shocked anda little scared. Not to mention angry. 

I want to see this stooped and if we can prosecute the verson resconsibée, 
reat, but I really doubt we can do this unless we start tapping chone lines 
zr something. In any event, what I woeld suggest to the Catholic University 
s to tighten up their security a little, so that it's not so easy for non-users 
o communicate with users. And if anyone in the future is found to be using 
vy name, in any form, I wanr to be notified cirectly. Thank vou. : 

Sincerely 
b6 
b7C 
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ou ate University of New York st ‘Stony ‘Broo 
e g Island, NY 11794 


Stony Bra OK @ . | | telephone: (516)_246-7000 


June 24, 1981 


Computer Center 
The Catholic University of America : : b6 
Washington, D. C. 20064 . p7c 


DearL_ FC 7 


Following receipt of your May lst letter and the attached records on[ 
interaction with Catholic University's computer, we have consulte b6 
with legal counsel and with our campus Computer Center. We have concluded that y7c 
actions at this end do deserve limited action under our campus 
judiciary code, but do not deserve criminal proceedings instituted by Stony Brook. 


The University's legal counsel suggests that there may indeed have been a 
criminal offense directed toward Catholic University through theft of time on 
your computer. However, our counsel further states that Catholic University 
should be the party ma king a determination cn whether criminal ‘proceedings should 


Be instituted in this case. 


reviewed the materi- 
al you forwarded_with members of his staff. He noted that there was interaction 


initiated by but he also noted that that interaction was available 6 
through straight telephone access and that none of the reported conversations in- is 
cluded’ any requests to to get off the line; none of the reported conver- 
Sations indicated that was bothering the users with whom he was convers- 


ing or was hampering their operations. 


eo 


We will be charging[____|with unauthorized use of University Services. 
We will certainly make it clear that from our standpoint his behavior was inappro- 
b6 


priate and violated our Student Conduct Code in more than one way. 
b7C 


You may also wish to hnow that the terminal fron which[ __|vas operating. 
has been removed from the radio station. It was 2 personal machine belonging to 
another student. It was to have been used for developing record files. Any such 


cGevelopment in future will be strictly monitored by the general manager of the 
radio station. 


I ‘appreciate very much your_willinoness to share with us the full report of 


information that you had about| ___] appropriate interaction with your 
computer. Please let me know if we can help you in any other way. . b6 


b7C 


Very truly yours, 


ELW:aj 
Peel , | ? F-64 


; , ss fice of the Vice President for Student Affairs 
© A Beg - te University of New York at Stony Brook 
2 os Story Brook, NY-11 794 
telephone: (516) 246-7000 


Stony srook 


MEMORANDUM. 


Subject Investigation off sd case b6 


b7c 
Date June 18, 1981 


- At your request I have pursu.i the matter off suse 


of a computer terminal in W.: to access the computer at_Cat j 
University in Washington, D. °. I have ‘consulted with 
University C osuting Center, and as 


graciously reviewed the case .1d consulted with several members 

of his staff. has ported to me that the log of the 

transactions sent to us by C holic University does not show that 
used criminal mea: to gain access to their computer. 


~ In fact, the way in which th: = system is set up, they permit 
access without a po seeed es added that_there is no 
. evidence that anyone at Cathc ic University orered| to 
get off the computer or in an: way indicatedhe was bothering them 
or hampering their _overetions. From perspective, we 
should focus on Lrauthorized use of University tele- 
phone lines; his questionable :.ffer to trade property, which perhaps 
did not belong to him, to gain access to another system; and his 
foolish interference with computer operations at another university. 


b6 
b7c 


Based upon this review, feel that{_ «dS SHlowid Ee charced under 
the University Student Conduct Code and receive a letter of warning 


and disciplinary probation from the University Hearing Officer. I 
believe that this matter does not warrant further acticn. b6é 
b7C 


Lf you require additional information, please see me. 


'SRT/1p 
ae ¥5, b6 


* 


. ® , : 7 : a>. ofthe Vice Pieti@ent for Seetcat ATS leg . 
; State University of New Yeu. at Stony Book 
Stany Prook, NY 11794 
telephone: (316) 246-7090 


35. ™e moe 2°N }: F . 
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MEMORANDUM .- 


To 


rom LO ke 
b7C 
Dute June 18, 1981 
I wish to thank_you very much for your help in the _investication 
related to the[ ease. Your review of[ BE 


transactions has been very helpful and has enabled the University 
to determine: how to proceed in this matter. 


= Thank you again for your cooperation. 
SRT/1r 
5 b6 
X2.Ci2 b7c 
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State University of New York 
State University Plaza 


Albany, New York 12246 . 


Office of the University Counsel , "os: 


and Vice Chancellor for Legal Affairs 
(518) 473-7591 


Administration 355 
tate University of New York 


Stony Brook, New York 11794 


¢ 
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I have reviewed the materials which you submitted in rela- 
tion to Catholic University of America's complaints about attempts 


at unauthorized computer access made by an individual identifying 
himself as[ at. WuSB. 


Although the facts present a rather unique case, I concur 
with analysis that the Rules of Student Conduct may be 
implemented in student disciplinary proceedincs on campus. Since 
there is no specific category in the prohibited conduct section 
of the Code covering misuse of University telephone lines for the 
purpose of securing illegal computer access, I 
alleged misconduct falls within the general sections relating to 
"Respect and Protection for Persons and Property" (Section A-1) and 


suggest that the 


the “Integrity of Transactions and Records" (Section A-3}). 


More specifically, these sections provide that: 


"A(1) (b>) No student shall take, 


possess or 


damage any property not his/her own on the 
University campus or on any University 


prcosertv."” 


and 


"2(3) (ad) No student shall knowingly take or 
use any services without authorization." 


b6 
b7C 


b6 


b7c 


_ There may be other sections which you feel are more appropri- 
ately utilized than these cited. 


tional difficulty. 


F-67 


In any event, 


I see no jurisdic- 


- b6 
Po June 3, 1981 Po. 


Page Two 


If I can be of further assistance, please feel free to 
contact me. 


Very trul 7our 
b6 
b7C 
GJD:set 66 
cc: 
b7C 
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May 29, 1981 
b6 
b7c 
cministration = 
SUNY at Stony Brook | 
Stony Brook, NY 11794 
CONF ERENE EL 
b6 


Dear[__ BIC 

I have reviewed the file on[ sidan I believe that there 
was a criminal offense which probably in the last analysis will be 
cetermined to have occurred in both the State of New York and the 
District of Columbia. However, the victim of the theft, Catholic 
University of America, should really be the party making a determina- 
tion where criminal proceedings should be instituted, if at all. 


roy 


With respect to any student disciplinary proceedings on campus, 
I would assume something in the Rules of Student Conduct would cover 
a Stony Brook student utilizing the University telephone lines for . 
the purpose of meking long distance calls and securing illegal 
access to another wiversity's computer. You should, therefore, con- .- 
sider whether as a matter of policy you desire to institute such i 
Student Conduct Code proceedings against the student. . —- 


ae Counsel's office has expressed a strong interest 
in this matter and I am, therefore, this date forwarding to her all 
of the materials which were just received from you together with the 
copy of this letter. ; 


Sincerel ours 


hae b6 
. b7c 
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THE > 
CATHOUC UNIVERSTY a 
OF AMERICA CO 


WASHINGTON D.C. 20064 . 


COMPUTER CENTER 
2O2 635-5373 


May 1, 1981 


———— = - SUNY 


State University of New York at Stony Brook 
Stony Brook, NY 11794 


Dear[ 


As I promised in our phone conversation Thursday, 
April 30, 1981, enclosed are copies of the pertinent dialog - 


between three different CUA computer users and_someone who has 
been accessing our DECsystem-10 claiming to pf an 
es ft SUNY/Stony Brook and an employee of Radio 
Station wWUSB. In the printouts, dialog beginning with 
";;TTY56" is from the "phantom" caller, and dialog beginning 
with "SEND TTY56 ..." is from our user. (The number of the 
terminal, TTY56 above, may vary--this is because he was 
dialing into the system and getting a different line each 
time.) In most cases, his messages appear in lower case 
characters and our user’s appear in upper case only. 


The problem was first brought to my attention Thursday, 
April 23, 1981, when one of our part-time programmers gave me 
a printout (see Item 1) of a dialog between himself and 
someone who claimed to be named Eric who was offering to trade 
record albums for an access code to our system. The caller 
claimed to be working for WUSB and using a terminal located in 
the station. He told of exchanging five record_albums with 
one of our students namedl fin exchange for access 
code to our system. When we checked the code he had been 
uSing, we found that it had not been issued to anyone named 
CT We did talk to the person to whom the account was 
issued and are fairly certain that he was a victim of someone 
on our campus uSing his access code. 


. Friday, April 24, 1981, a graduate student brought me a 
printout (see Item 2), again of a dialog with this time 
offering to trade access to long-distance telephone lines in 
exchange for a system access code. The caller gave our user a 
local phone number to call, two access codes for the 
communications system and instructions on how to use them. 


— ho py by hea been Ca 
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b6 
b7c 


b6 
b7c 


b7c 


b6 
b7c 
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a es as May 1, 1981, qt. Page 2 PE. 


At this time, I talked with a representative of C & P 
Telephone Company. After a check, he told me that the lines 
being used were not Bell Telephone lines, and therefore, they 
were not interested in the problem. I next talked to a 

an investigator for MCI Communications. 
‘He was most interested and most concerned about this activity. ae 
He subsequently checked, however, and found out that the 
access scheme was not MCI, but was one belonging to Southern 
pacitic Communications, ttaikea win ee 
SPC. He told me that the long-distance access codes belonged 
to two California firms, and that they would begin to monitor 
the usage of the two codes. I sent him copies of some of the 
pertinent printouts. 


called me Thursday, after I spoke with you, 


to tell me that he had somehow examined the account _activit 
- for March for the two access codes and learned a 
b6 


2 ee several calls using these.codes. He also told 
me that he had talked with of SUNY/Stony BIS 
Brook and had confirmed that was a student there. 


Be indicated that no action had been taken. I gave him your 
name and phone number. I assume he has since contacted you. 


Both firms expressed that while they are concerned about 
illicit usage of their phone lines by a person claiming to be 
a Student, they are most concerned about the damage that could 
be done if the numbers were given to a "professional" who 

'£ully understood their usefulness. 


Meanwhile, our Systems Programmer began taking steps to 
temporarily limit what'a user could do on our system without 
having an access code. This patch was in use over the 
weekend, so we do not know what, if any, access this person 
tried to obtain. However, the patch had to be removed Monday 
morning and a more permanent fix applied. This was not 
accomplished until Thursday morning. 


This person was again on the svstem Tuesday night. Both 
the user who "talked" to him last Thursday and our Night 
Operations Shift Supervisor engaged him in dialog over the 
system. Printouts from both dialogs are included. Our user 


this time managed to extract the last name of (see b6 
tem 3) and also that h Csystem— while he was b7C 


a Student at Our Operator did not 
: learn anything which we did not already know. : 


In addition to the events we can Gocument with printouts, 
I have had numerous students, faculty and even staff members 
of the Computer Center tell me that they had at one point 
‘received unsolicited messages from this person. Unsolicited 
messages serve only to interrupt someones work and to distract 
them from what they are doing. In the case of one user, he 
had to reprint several pages of a document because a "garbage" 
message was in the midéle of it. 


aes 
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The person calling himself] __has twice given 
our people the phone number of WUSB. now of one occasion 
when our user actually called the number, asked for and 
actually spoke with someone claiming to be 


‘Of more serious import, Tuesday night during the dialog 
with our Operator, the caller gave him the phone number (see 
Item 4) to access your Univac computer system. I am sure that 
my counterparts in your Computer Center would be most 
interested in this. 

We would like to see this activity stopped. As I have 
indicated, we have taken steps to tighten our own system 
security. 


Clearly, this may be a situation in which the caller does 

not realize the seriousness of his actions. However, we 

- estimate that we have spent over $1,000 in staff time alone 
dealing with this problem. We view this as harassment of our 
emDloyees and our users. This activity, from our 
understanding, is a Federal offense if the calls are coming 
across state lines from New York to Washington, D. C. In 
addition, this person has admitted using SPC lines without 
authorization which is probably also a violation of statutes. 


We appreciate your taking action on this problem. Please 
feel free to contact me if I may be of further assistance. I 


would appreciate your letting me know the outcome of this 
Situation. ane 


“ Sincerely, 


AAR: met. 


=nclosures 


Faye 


’ 
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(Communications Management cngincenng 
eo e President for Administration 

South Campus Building A, Room 142 

State University of New York at Stony Brook 

Stony Brook, New York 11794 

telephone: (516) 246-3500 


Stony Brook 


MEMORANDUM 


. . b6 
From Cy Ne b7C 


Subject WISB Telephone \ nven dry 


Date October 26, 1983 


Attached is a listing of all telephone lines leased to WUSB Radio 
Station. The list is broken down into two categories, the first part consists 
of 6 telephone lines, only one of which is capable of reaching long distance 
(7122). Also attached is the billing for this phone from May, 1983 through 
Seotember, 1983. The remainder of the phones cannot reach long distance, 
however, the two phones with A2N service can reach all of New York State and 
Washington, D. C. and vicinity. Unfortunately, our antiquated Centrex phone 
system is not able to identify calls made on these tie lines. 


The second part of the list labelled radio circuits are used through- 
out the campus to interconnect various locations such as the Gym back to the _ 
studios to broadcast sporting events. ; ; 


The potential for a bright technical oriented person such as the 
involved parties is to ccnnect anyone of these radio circuits to any phone 
circuit on campus in the many Telco closets scattered throughout the campus. 
In effect this would mean they would be abie to make calls from the studio via 
these circuits cn anyone's phone line which in most cases goes umetected 
because very few derartment heads question their telephone bills cn a thorough 
basis. 


The Message Unit Detail (MUD) reports which I promised are still being 
processed by the phone company and should be available in about 1 week. This 
will give you all local calls made on these phones in the 516 calling area for 
approximately 6 months. 


. If there are any questions that may surface regarding the attached, 
please call re. 
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Federal Bureau of Investigation 
ATTN: 

300 Lee Street Room 500 
Alexandria, VA 22314 
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BS oa 
I told you then, I have racetved: ‘plone alia © ever an ; 
again asking for this person. 

Now isaase the encl.osed arrived in the . : 
couldn't find a box for it otherwise. ‘Thavérte ‘say °, hie’ -phone. calls i 
looking for him, its the first time a letter ‘Was. addréssed to: ‘him here. Pos. Gre a0 
The address is not even correct, we don't have a number suchas: B-16, . ere 


If its of any help you are welcome to it. .There is no return address shown 
to send it back to and I refuse to get involved any further by reading it 

or learning more about Roger. The less I know the better I feel. If 
anything further comes to my attention I will advise you.. 
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Published monthly by 2600 EN LER PRESES. an eheemasynary organization. Subscription 
rates are $10 annually Weite 10 2600, How 752. Middle Island. NY 11953 


AHOY! 


(That's how Alexander Graham Bell used to answer his phone. For some reason, it never caught on...) 


© 
January, 1984! 


VOLUME ONE, NUMBER ONE 
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This is the very first issue of 2600. We will, on this 
page, explain our motives and what the goals are 
which we hope to achteve with this publication. 

The idea for 2600 was born early in 1983. Wesawa 
tremendous'need for some form of communication 
between those who truly appreciate the concept ot 
communication: technological enthusiasts. Of course. 
others nave different ways of describing such people — 
these range from words like hacker or phreaxer to 
stronger terms such as criminal or anarchist. Our 
purpose is not to pass judgement. 267 exists to 
provide information and ideas to individuals who tive 
for both. All.of the items contained on these pages are 
provided for informational purposes only. 2600 
assumes no responsibility for any uses which this 
information may-be put to. 

Of course, a lot has changed since our first davs. 
War Games came out. And then the 414 gang got 
caught. Suddenly everyone was talking about 
phreakers and hackers. And while there were some 
that sort of jumped into the limelight, others were a bit 
more cautious, in fact, some were quite upset. Sure. 
the publicity was fun. But what would be the cost? 

Well. time has passed and the cost has been high. 
Phreakers and hackers have been forced into virtual 
tsolation. Raids oy the FBI have become almost 
commonplace.. The one magazine that was geared 
towards phone phreaks (74 F) mvsteriousiv disan- 
peared at the herght of the crisis, sparking rumours 
that thev. too, had been raided. However. in 
November. the magazine resurfaced. with an 
explanation that a fire had destroyed part of their 
matling list. (Incidentally. if your name was one of the 
ones that was lost, vou can claim the issues you are 
entitled to by sending 74P a copy of their mailing 
label or a cancelled check.) 

And then there was the legendary computer bulletin 
board known as OSU VY. Enthusiasts from all across 
the country called up this board and left messages 
ranging trom the latest in Sprint codes to how to crash 
an RSTS system to what to do once you've tinally 
gained access to Autovon. Within a week after being 
mentioned in Vewsweek, OS UN Y was disconnected. 
Word has it that they are still in existence somewhere. 
but by invitation only. A truly smart move, tf that is 
the case. ; 

Many hackers were keeping a low profile even 
before the October raids. When the FBI confiscated 
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equipment trom [5 sites across the country on the 
twelfth and thirteenth of the month (sponsored by a 
giani from the folks at STE}. many of our contacts 
were fost because they feared the consequences of 
continuing. Two organizations, the Inner Circle and 
PHALSE. were deeply atfected by the raids. The latter 
group (whose initials signify Phreakers. Hackers. and 
Laundromat Service Empiovees)is sullin contact with 
us on occasion and has promised to contribute many 
articles devoted to just what was reaily going on. 

So it seems that the events vi i983 have conspired lo 
actually vrenginmen the resoive ot cackers 4nd 
phreakers across the country tO put Out this monthly 
newsletter. We hope you will help us continue oy 
subscribing, spreading the word among vour triends. 
and of course contributing articies and intormation. 
Since we are non-protit, it realiv doesn: mattertousit 
vou xerox your copy and send if (0 someone else —ail 
we ask is that vou let us know so that we can have a 
rough idea of how many peopie we're reacning. 

2600 has several sections. some of which willappear 
every month, others on an irreguiar basis. On this, the 
front page. and on page two. vou will aiways find 
informative full-length features on reievant subjects. 
Future topics include: “A Guide to Lung Distance 
Telephone Services and Their Vulnerabdiinues”, “DEC 
and Their Many Mistakes”. “Phreaking in the 
Sixties’. and “Tracing Methods Used by the Law”. as 
wellas ans late-breaking items. “FLASH” uppeurs on 
page 3 and provides a roundup of Umelv news items 
written from a technological enthusiast’s perspective. 
Page 4 1s used for a variety of things --interesting 
stories from the past. schemes and plots that just might 
work. and feedback from subscribers. The last two 
pages of 2600 are comprised ot data. Just what sort of 
data, we cannot say. However, tf itis something that 
you are looking for, then you wiil probably recognize 
it. 

The three holes on each page serve a purpose. We 
suggest that vou obtain a loase-ieal book so that vou 
can neatly tile every issue of 2600 vou receive. 

Many thanks to those of vou who subscribed 
without even seeing an issue. A word of advice, 
though: don't do it again or you'll probably get ripped 
olf! We'd also like to thank those who took advantage 
ot our tree issue offer. Hf interested in subscribing, the 
rates cind address can be found at die typ of this page. 

Welcome to 2600, Turn the pave and become a part 
of our unique world, 


FBI GOES &FTER ADSSIACKERS | 


IBM must press charges before action can be taken — Feds reveal their tactics, blow source 


On this page we hed originally planned to run an 
article entitled: ESS — Orwell’s Prophecy. At the last 
minute. however, we received this bombshell from<an 
anonymous contributor. I[t seems that a group of 
hackers was making use of one of IBM’s ADS sys- 
tems. (Audio Distribution Systems enable users with 
touch-tone phones to send voice messages back and 
forth to each other. Look for an in-depth article on 
them in a future issue.) Unfortunately, as ts all too 
often the case, one of these hackers was really an 
FBI informant who was taking note of all of the 
illegitimate users (around 40 or so). Luckily for 
this particular group, the informant was sloppy and 
left many telltale clues which gave them literally 
months of warning. So, when the informant de- 
cided to send a message to the system operator, 
aduising [BM to take action against the hackers 
and to call the FBI for more information, the 
hackers were ready. The system operator’s account 
had also been penetrated by them and hence, the 
message was received by the hackers first! One of 
them actually followed the instructions in the 
message and called the FBI! And for some reason, 
the investigator there ‘thought he was talking to 
an IBM executive. This is some of what he said. 


One of the individuals that supplies me with in- 
formation from time to time has uncovered a lot of 
abuse within the ADS systems, not only here in the 
United States, but in England and Italy. I talk to 
this individual on a private bulletin board. . .- 

We have no ability to come in as an outside in- 
vestigative or law enforcement agency and do any- 
thing about it because. first off, we don’t have a 
complainant. We don’t want to step on anybody's 
toes, but it’s been our policy to monitor bulletin 
boards and the phone pnreaking activity across the 
country and advise commercial computer systems and 
corporations if we do discover certain computers 
along with the passwords and account numbers being 
published on the board. We do this on a one on one 
basis. 

The GTE Telemail Connection 

That was my baby, too! Asa matter of fact, that’s 
how we came across the ADS system — through the 
GTE investigation. [These] people are not just in- 
terested in data communications through terminals — 
they will leave voice messages on an ADS. We have 
been slowly uncovering more and more on the ADS 
in the last two months. 

The major phase of [the Telemail investigation] 
was about 20 individuals that we had located and 
identified and we're looking for indictments on most 
of them coming down in the next month or two. 
We're talking about a group of highly organized 
people that do communicate on a daily basis all the 
way across the country — from San Francisco and 


L.A. to Denver to upstate New York. So we havea 
core of individuals that we are still looking at that 
are using your system and then we have this peri- 
Pheral that we are not as concerned about because 
they are not part of an out & out conspiracy or an 
Organized network, per se. [| know of at least 8 or 10 
that are the central figures in this, the carryover 
from Telemail. And we keep. hearing information of 
other people who are calling in with junk messages — 
there’s no real substance to their messages. Now the 
reason [ know that is that they have included one of 
my sources of information onto their svstem and so 
he gets messages from the other parties. 


The Communist Connection 
In a way we're somewhat fortunate that it’s 16- 
year-olds or 26-year-olds as opposed to people from 
behind the Iron Curtain. It gives us the opportunity 


_to see how these systems work and see if we can plug 


any loopholes before somebody from a not-friendly 
nation would try the same’thing. I personally fully 
expect it — I’m surprised it hasn’t happened in the 
past. It may have. We just haven't caughtit. But the 
kids are a little bit sloppier and they're getting 
caught. . . [ hate to sound paranoid. but we’re sup- 
posed to be considering the big picture as far as is 
there anything sensitive in nature. For us within the 
bureau, sensitive in nature first off means national 
security and you’ve got corporate trade secrets and 
the like that you don’t need being distributed. 


‘How the FBI Wins Trust and Gets Info 

The subjects have an ego problem and they love to 
talk to other individuals about what they are capable 
of doing and bragging about it. They have a tendency 
to trade information. Everything Is negotiable with 
them. We have never had to barter away access to 
systems — we do it more on the technical information 
of phone networks, computer systems, and the like 
to where it’s more of a technical information tradeoff 
as opposed to an access tradeoff. [An example would 
be the] login procedure for a PDP-11. You integrate 
yourself within their confidence and their circle of 
friends. You feed them a little bit of bait and a lot 
of times they'll go for it. You enter into a dialogue 

with them and they end up taking you for a ride. 
These people are very hungry for technical avenues 
through which they can communicate. It used to be 
the personal computer bulletin boards — public 
messages that anybody can read. You Start finding 
out that they leave a phone number or an address — 
and you start finding out who the parties are. There's 
thousands of these bulletin boards across the country 
and you narrow in on maybe twenty or so that are 
the more hardcore bulletin boards that are being used 
for exchange of illicit information. Then they move 
from there to an electronic mail service. namely GTE 
(Conunued on hack page) 
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GTE raids still have many unanswered 
questions—computer owners concerned 


Combined News Sources 

On Wednesday. October 12, at 6:00 AM, the FBI started 
to raid the homes of over fifteen individuals for allegedly 
breaking into Telemail, GTE Telenet’s massive electronic 
mail service. While much of the publicity has now died 
down, questions remain concerning the legality and the 
overall implications of such computer seizures. 

Ata December |6 meeting of the Long Island Computer 
Association, this topic was addressed. Some members could 
not understand the rationale for taking away the computers 
in the first place. “!t sounds like scare tactics to me... to keep 
these kids oft of computers,’ one commented. “To nold the 
equipment seems like something that should be unlawful 
and it’s something that the public should look at. If it’s not 
justified, we should say that we won't put up with it anymore 
and to return the equipment.” He did not elaborate on 
precisely what kind of action a commputer group such as 
LICA could take. 

Legally, the computers can be kept for as long as they are 
needed in the investigation. Ultimately, a judge will decide 
how long that can be. 

“The allegation,” said an attorney familiar with the case, 
“is that the services of the Telemail bulletin boards were used 
and the theory that the government is proceeding under is 
that it was a violation of Section 1343, wire fraud (a scheme 
with intention to defraud someone else using either 
television, telephone, or some other communications 
means). They’re saying that if there was use of the bulletin 
board service, then that was a ‘theft of service’ and there was 
intention to defraud GTE.” 

One member took GTE's side. “These are all nice games 
these people are playing, but they are a theft of service. 
Somebody is in the business of providing that service and 
they're deliberately interfering with their providing that 
service. They're trying to get something for nothing.” 

Another disagreed. “You may be on their computer, but 
it’s not costing them anvthing, if you're not taking up time. 
Unless the whole system is fully used and you were the last 
user on, are you really using any of their time? Really and 
truly?” 

Many hackers felt they were unjustly accused. One even 
said he’d never used the Telemail system. Others said they 
had looked around once or twice but had never hurt 
anything. Others, though, admitted to deleting mail and 
playing tricks, like sending obscene messages back and forth 
between two innocent executives. 

Whether or not the Telemail system was used fraudulently 
did not seem to be the overriding issue at the LICA meeting. 
What had members there worried was the way in which the 
investigation was being carried out. When dealing with 
computers as evidence, different rules apply, rules that for 
the most part have not been written yet. “Data can be 
manufactured just as easily as it can be erased from a 
personal computer,” one member commented. “And the 
longer that they have the computer in their custody, the less 
likely that the information that they claim is on it was 
actually there. Because, as we know, you could enter any 
date, any time into the computer and have it date- and time- 
stamp the files.” 
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Meanwhile, a GTE Telenet spokesperson said that the 
corporation still intends to prosecute and denied that the 
whole thing was being put on for the deterrent effect that it 
might have on other people. The spokesperson also said that 
abuse on the system was discovered in the past, but they 
didn’t prosecute at that time. This time. though, they're 


serious. 
AT&T Credit Cards Make Debut 


2600 News Service 

There’s now another way to place telephone calls without 
dimes. This month, the “true” AT&T credit card phones are 
making their debut in various airports around the country. 
This new phone actually takes an AT&T credit curd (not 
those wimpy “calling cards” or “PIN cards.” We're talking 
about a rea/ hunk of plastic. with a magnetic strip and 
everything.) — and there’s even a little video screen that 
gives vou directions. i 

Unless some sort of a bug can be found within the system 
itself, phone phreaks won't accomplish very much here. 
unless they can actually get their hands on other people's 
cards. This, in itseif. wouidn't be too ditficuit, since farge 
numbers of the cards would be sent out on the same day ina 
particular area. Stealing out of personal mailboxes, thougn, 
is an act most phone phreaks would never stoop to. And the 
folks at AT&T are weil aware of this. 


Wireless phones spell trouble 


2600 News Service 

With cordless phones popping up all over the place, 
problems were bound to arise. It’s not at all uncommon to 
hear another cordless conversation on your phone or to hear 
the electronic pulse-beeping when vou're not even dialing. 
Then there are cordless phone phreaks to deal with. who 
drive into heavily populated zones holding one of the 
common cordless models. It's called “cruising for 
dialtones.” And some phones are nice enough to broadcast 
your conversation on an AM frequency. This feature isn't 
very good for private conversations. It helped shape a recent 
drug bust in the state of New York. 

Recently, a lady in the Midwest called up her local electric 
company to tell them that she was going to be away for two 
months. A member of the 2600 Club heard this on his radio 
and, being in a good mood, called her and told her that 
important, personal business should never be discussed on 
cordless phones. After thanking him, she exclaimed, “That 


‘thing's going right back to the Phonecenter Store! 


1984 arrives in Hong Kong 
The Los Angeles Times 

In an effort to “discourage people from driving their cars 
in heavily congested areas” all 350.000 of Hong Kong's 
motor vehicles will be fitted with tracking devices that will 
let government computers know exactly where each car has 
traveled so that the owner can be billed for road use. This 
system could be in full implementation by 1987, if the 
government has its way, Such a system would also allow the 
police to quickly pinpoint the whereabouts of any vehicle. 
Tampering with the $45 tracking devices will be illegal and 
any attempt to do so will trigger street cameras to 
photograph the license plate of the car. 
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THE TRUTH BEHIND THOSE 9999 NUMBERS 


by Mark Bluebox 

Once upon a time, | was talking to one of my favorite 
friends, one of the nation’s oldest and most experienced 
telephone enthusiasts some might refer to him as a phone 
phreak. In this particular conversation, he mentioned to me 
that | might want to experiment with a series of 800 
numbers: exchanges starting with 9. followed by the sulfix 
9999 (800-9xx-9999). And so | did. and a whole new world 
began to open up in front of me.’ 

Thev were mostly weather and time numbers in various 
locatuuons throughout the country. And, since these were 800 
numbers, there was NO CHARGE! One number in 
particular was of a great deal of interest to me and to many 
others. This was 800-957-9999, which hooked upto WWV. 
the radio station operated by the National Bureau of 
Standards that does nothing but tell the time and xive 
shortwave reports. This is the most accurate clock in the 
entire world! You either have to tune WWV in on a 
shortwave receiver or dial 303-499-7111 in Fort Collins, 
Colorado. Yet, here | was with an 800 access! Beinga bit ofa 
shortwave enthusiast. | don't have to tell vou how 
convenient this was for me. Unfortunately. it got too 
convenient for too many people. | 


I guess | made the mistake of giving it to a former - 


president of a large amateur radio club in the Dailas area. 
He, in turn. printed it in the Amateur Radio Newsbuiletin 
where thousands of people probably saw it. Another 
statewide newsbullctin picked it up and printed it. Through 
an amateur radio news network which this bulletin was a 
part of, the news got as far as California. 

One day, | called up the West Link Amateur Radio News 
Service at 213-768-7333. (This is a service located in West 
Link, California that broadcasts news over amateur radio, 
VHF, UHF, etc.) Their latest report had this little item: 
“Speaking of interesting things, the National Bureau of 
Standards has got a very convenient time number for those 
of vou that are not constantly at a shortwave receiver. You 
can dial 1-800-957-9999 for WWV. It’s just another good 
toll-free service for us to use.” The avalanche had really 
begun now. 

The West Link report was heard on bulletin stations all 
around the world and, apparently, one station in Nashville, 
Tennessee broadcast it. From there it fell into the hands of 
one of the writers for the DX program on Radio South 
Africa! | happened to be listening to a program where they 
were talking about pulling in distant time stations, weather 
stations, etc. He then mentioned, “For those of you that live 
in the United States, a convenient toll-free 800 number has 


been provided by the National Bureau of Standards for 
WWYV and that number is 1-800-957-9999." Imagine my 
surprise! Once again, the number had been broadcast all 
around the world. People in many, many nations now had 
that number. Of course, the number only worked inside the 
United States. but the word was being spread by shortwave 
listeners and QSL people everywhere. 

The number was getting swamped. Needless to say. it was 
busy much ol the time. A government official, who a/so had 
this number, thinking that it was legitimate, called up WWV 
and complained. He told them that they needed to add some 
more lines to their new 800 number. The general manager of 
the station said, “I don’t know what you're talking about. | 
don't know of any 800 number that gets you WWV." 

The government official told him what the telephone 
number was. The general manager called it and heard his 
own Station. Astounded, he contacted the Mountain Bell 
Telephone Company in Denver, Colorado. Thev said, 
“You're not paying for any 800 in- WATS number. We show 
303-499-7111 for WWYV, but we don’t have anv ¥00-957- 
9999.” 

Mountain Bell checked it out and sure enough. the 
number existed but not on their records. No one was getting 
charged for this! Now, of course, you know a monopoly as 
well as | do—they're sure not going to let anvone havea tree 
ride. So they told the WATS coordinator to find out what 
happened. He finally made the discovery that some 
technicians had hocked that number up for transmission 
testing. [These switching technicians are toll technicians, 
AT&T Long Lines switching technicians, and carrier 
systems technicians. In other words, they're the group of 
people who link switching centers together, from New York 
to Los Angeles, for example. In this case, the whole 
escapade was a kind of group effort. The switchmen and the 
carrier people got together and set up this number for 
testing, finding noisy carriers, carriers with cross-talk on 
them, etc.]} , 

The WATS coordinator told them thev'd better get this 
number off—too many people knew about it. He told them 
to erase every 800 test line number that was on the system. 
Not surprisingly. someone also got chewed out very 
severely. 

So, consequently, 800-957-9999 is no longer in existence. 
But since then, less than two weeks later, several ot the 800 
test numbers have begun to defiantly reappear. Check 
around, you'll probably find a few interesting ones. But ! 
doubt if WWV's brief stint as a toll-free service will ever be 
repeated. 


Ahoy, folks! If any of you have ever 
used an extender that goes by the name 


of 8006213129, you'd better give it a call 


now! The people 


running it have a 
message for you.  ;.,, 
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Position Name Extension Position 
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The President Ronald Reagan 2858 Deputy director of ad- Hugh L. O'Neill 7586S 
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Special assistant Mitchell F. Stanley 2235 Dan Morris 1565 
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or . . Deputy director of Tricia Rodgers 7560 
Administrative assis- Karen Hart 2823 : 
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Director of planning and Richard S. Beal 6690 Staff assistants Michael Castine 7560 
evaluation . Frances(Fan) Snodgrass 7560 
Office of Chief of Staff Netta A. Dickey 7560 
Chief of staff James A. Baker Ill 6797 Confidential assistant Mary H. Rawlins 7560 
Executive assistantto Margaret D. Tutwiler 6797 President's dianst Ellen Jones 7560 
the chief of staff Aapointments secre: Helen C. Donaidssn hice) 
Staff assistant Kathy Camalier 6797 vary ; 
Confidential secretary Margaret Glasscock 6797 Staff directory forthe First Peter McCay $702 
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Administrative assis- Sara Currence Emery 2702 NO MIMISEPaL¥E aSSIS- Christine J. Hatnasay 2702 
tant . . tant 
Secretary Janet F. McMinn 2702 Press secretary Sheila P Tate 7136 
Special assisiant to the James W. Cicconi 2174 Assisiani press Secre- = Barbara Cook 7136 
chief of stafl tary 
Presidential correspon- Anne Higgins 7610 Personal secretary Elaine Crispen 6633 
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Special presidential mes- Dodie Livingston, 294) Assistant social secre: — Linda Fauixner 7 
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‘Office of the Deputy Chief of Staff Scheduling director Nina Mormset 7910 
Deputy chief of staff Michael K. Deaver 6475 pecial projects Ann Wrobieski 1995 
Assistant lo the dep Joseph W. Canzen 2961 Office of the Vice President 
uty chief of suafT The Vice President George Bush 712 
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Special assistant tothe _ James 5. Rosebush 2957 termeyer 
President for private im Chief of staff Daniel J. Murphy 6606 
Lidtives . Denuty chief of staff Richard N. Bond 7556 
Eacculive assistant Bernyce Fletcher 2987 Miltary assistants Lt. Col. Michae! D. Fry 4213° 
Director of special support Edward V. Hichey Jr. 2150 Li. Col. Wiliam Ecuen 4223° 
SeCwiCes Counsel C. Bovden Gray 7034 
Deputs director of Dennis E. Le Blane 2150 Deputy counsel Rafael! V. Capo 7034 
special suppor ser- Press secretary Peter Teeley 6772 
vices : Deputy press secre- Shidley M Green 6772 
Deputy director of Col. Frank E Milner 2150 lary 
military office Speechwriter Christopher Buckley 7453 
Army aide 10 the Li. Col Jose A. Murat: 2150 Domestic policy adviser Thaddeus A. Garrett Jr. = 2173 
President Jr. Assistant domestic Mary S..Gall 7935 
Att Force aide to the May. Wilham M. 2150 policy adviser 
President Drennan National security affairs Nancy Bearg Dyke 4243 
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dent 


Alitelephons numbers ars on the 356. crachanee cacept thos: marked with an asterisk, which are on the 395- excaange, ind 


. : : ’ 
ties ietes an Tull! 
eee 


and scheduling 


Proper tabbing is extremely important when typing a list. Above is an example of tabs used successfully. 
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This here page is usually a con ration of page 5. However, whee get a hlockbuster story 
like the one below, we have to reallocate our space. We know you'll understand. By the way, 
as long as we've got vou looking up at this part of the page, why not take the time to send us 
some mail? Letters, articles, information, old telephones, paintings, anvthing, really. You 
know the address (it's on the front page). Let’s hear from YOU. 


FBI VS. HACKERS 


(Continued from second page) 

Telemail. They caused fits within Telemail when 
they decided to get a little bit cocky and see if they 
could shut down accounts and change passwords of 
the administrators and things like that. From there 
they have moved one step further to where they are 
now the same individuals communicating through the 
ADS systems and they also set up conference calls 
through the Bell System, so they're not just attacking 
one particular system or one individual avenue of 
communication — thev try to hit them all. It’s an 
ego trip for all of them. 


Pen Registers 

We would put a pen register on ine pnone zine of 
the individual (suspect) and :t would record only the 
digits dialed on his telepnone — we wouid not use a 
full blown wiretap to record his voice. We can only 
put a pen register on an individual's phone for like, 
thirty days before we nave to go bDacx to a Judge and 
try to get an extension and we trv to minimize the 
use of our electronic surveillance equipment so the 
public does not think we're the Big Brother of 1984. 
(laughter) It’s coming. Actuaiiv, we're already 
there! (hearty laughter: 

We nave not utilized any pen registers for the spe- 
cific purposes of going after abusers of the ADS 
systems. First off. we nave to nave an actual case 
presented to us or a complaint. it's a roundabout 
way of doing ::, but it’s the way that we, in the 
bureau, have to have somebody outside come to 
us, Otherwise we can carry on the whole investi- 
gation without IBM even being aware that we are 
monitoring activity within their system and we 
don’t want to become that secret police, or any- 
thing like that. We want to be above board and work 
with the corporations in the community, 


Just How Much Trouble Are These Hackers In? 

On the federal level we can prosecute them for 
telephone fraud (fraud by wire) if we can determine 
that the ADS is an ongoing business operation and 
that you are being denied your just revenues by them 
sneaking onto your system and abusing your system. 
The strictest penalty is a $1000 fine and 5 years in 
jail for an actual conviction of fraud by wire vio- 
lation. Those are always lax — a more common 
sentence may be for an adult maybe a year in jail, 
18 months, or a fine, sometimes they get probation, 
or agree to pay back any fraudulent money obtained 


or for services rendered or whatever to the client 
company — it stays on his record for a year, he’s on 
probation for a year and at the end of that, his record 
is wiped clean. Rarely do they get the maximum 
penalty. It just doesn’t happen. 


Do Me a Favor 

Please do not disclose any geographic location be- 
cause we are kind of unique in that we do not have 
any other source available in any other part of the 
country that could supply us with information like 
this. He may be one of 200 people, but if you iden- 
tify Michigan you identify between 2 or 3 individuals 
and it may burn the source. 


‘We'd like to make it clear that we don't intend to 
do this kind of thing verv often. since rumours about 
certain people being informants are very common in 
this business. But this isno rumour. This, friends, ts 
solid fact — we would not have printed this story if 
we weren't able to substantiate the claims it makes, 
and we had no trouble at all doing that. Our intent 
in making this information known was not to screw 
up the FBI's fun (they're really not doing all that 
much out of the ordinary anyway), but rather to 
expose a very dangerous individual who goes by 
the name of Cable Pair (some sav his real name ts 
John Maxfield). This person has been posing as an 
extremeiy friendly hacker who lives in Detroit and 
is just bubbling over with technical information in 
exchange for your secrets. He claims to have been 
one of the nation’s first phreaks, which may or may 
not be true. He gives out his telephone numbers 
freely, will do anything to communicate with some- 
body (like place conference calls from his own 

. private PBX system, provided you give him YOUR 
Phone number), and generally will use anything you 
say to him against you in the future. Our advise is 
simple: stay the hell away from this person. Even if 
you haven't done anything wrong yourself, your life 
can still be. made miserable by him if you're even sus- 
pected of having contact with wrongdoers. 

This latest turn of events has saddened us — we 
thought Cable Pair would be a promising contributor 
to this publication and instead we learned a valuable 
lesson: don't trust anybody. Have fun, Cab-e Pair. 
Enjoy yourself. Just don't expect to see any of us 
over at the Chestnut Tree Cafe with you. You're 
on your own now. 
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The following is a summary of trap and trace infor, b6 
waation received verbally fromp dCi 


b7E 
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Date of transcription 2/ 1 O/ 8 4 
This is a summary of the activities off b6 


[jon GTE Telemail. b7C 


used the names[_ and bé 
on feTeuan. |. baie routinely used the 


—— : b7c 
legitimate account registered as[_sds ; 

[was a mem f a group of illegal users a 
called the "“PHALSERS". was registered as an illegal ne 
user in following companies: BMW, MARAVEN, TELENET, UAW 


and SCANNET. 


under one of his user names accessed 
the Telemail system on at least 247 different occasions 
between July 9, 1983, and October 12, 1983. Of those 
occasions, GTE Telemail captured 57 of his messages. 


A_fellow_"“PHALSER" has me and _ can definitely 
identify[ _jas and b6é 
ane described by this fellow PHALSER as the leader b7Cc 


of the group and as a part-time volunteer at WUSB Radio 
Station, State University of New York at Stony Brook, 
Stony Brook, New York. 


Information received from 


b7E 
stated to this fellow PHALSER that he 
found out that the FBI was about to search for computer 
equipment at WUSB. [si Jfurther told this person that 
he[ | was able to contact someone and get some material ae 
out of the room to be searched before the FBI searched ° 
it. A fellow radio station employee, 
told the FBI that, at the time of the search, gave 
instructions over the phone to[———sJconcerning 
2/6/84 Alexandria, Va. _, alexandria 196A-633 
{avestiqgatlonron..— a a ile eS ee ee 
| 3 ; b6 
a 9 ee f° eee sichiedic 27 OAB RS a a 
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the room to be searched. After the search,[ _]thanked 
for calling him and letting him know the room 
was ae to be searched. The fellow PHALSER also said 


that told him that_he had given a statement to 3 
the attorney representing admitting to his 
use of Telemail. also told the fellow 


PHALSER that “our story Meee be that I'm the only one 
who used Telemail." 


On Novem 6, 1983, [sf using the legitimate 
account known as left a message to the Public |) 
Relations Officer of GTE, stating that "we" represent 
PHALSE which is "an organization that has been rather b6 
active on the Telemail system over the past few months." b7Cc 
In subsequent easagee((o fdener teed the methods by 
which he and other PHALSERS penetrated the Telemail system 
and admits to reading the messages of legitimate companies 
(e.g. AMERICAN TELEPHONE AND TELEGRAPH messages). 


Finall 
b7D 
b6 
b7c 
During the search of the WUSB Radio Station, 
two computer print-outs labelled "Telemail System Command 
Manual" dated September 20, 1983, were found. These are 
"bootleg" copies of system information that only a legitimate 
Telemail customer administrator should have access to. BS 
These print-outs were found in the same room from which Bae 


at request, removed other material immediately 
before the searc 
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Date of transcription 


' b6 
(| aaa | b7c 


[ld telephone number 


this residence with 


said that he onl 
Terminal located in the bedroom of 


used _ the Data System 
in order to b6 


aes a —— which would b7c 
advised he would rather not discuss the 
activities of his use of the com- b6 
puter equipment located in bedroom. bic 
b6 
b7C 
investigation on Fite # BOl 96B-2942 
b6 
SAS pic 


and 10/13/83 


by Date dictated 
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FEDERAL BUREAU OF INVESTIGATION 


Dete of transcription 12/ 2 8 f 8 3 


telephone 
was telephonically contacted on December 20, 1983. b6 


b7c 
said he had spoken to various "friends" and based on 
their advice he had decided he did not want to talk to the 
Federal Bureau of Investigation (PBI) at this time. 


Investigation on 12/20/83 a, Hauppauge, New York Fie Alexandria 196A-633 
5 (Telephonic) Sub E 


vy SALES 12/21/83, ibs 


Date dictated 
b7C 
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FEDERAL BUREAU OF INVESTIGATION 


, Oate of transcription 12/28/8 3 


celephone| : was a by — Agent _ | 
telephonically from the Hauppauge, New York, Resident Aqency of the 


Federal Bureau of Investigation (FBI).[___]was told that the FBI b6 

would like to interview him concerning statements made to him by b7C 
on the telephone on October 13, 1983, at the time of an 

FBI search of the WUSB Radio Station on the State University of 

New York at Stony Brook. 


first stated he knew nothing about the incident, 
He was then told that the FBI had information that had b6 
askeq|__|to go to the room where the computers were stored and b7c 
remove certain materials before the agents could get to them. 
was further told that this removal of items by him might 
constitute obstruction of justice. 


[ |saia that he wanted to talk to an attorney and bé 
[_Jaaree to have his attorney call sal at b7c 


the Hauppauge, New York, Resident Agency. 


(Telephonic) 
Investigation on 12/20/83 at__ Hauppauge, New York Fite » Alexandria 196A-633 


Sub E 


ae dictated 12/2 Ad 83 b6 © 
b7Cc 
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f 
11/18/83 
Date of transcription 
called the Alexandria Office of the 

Federal Bureau of Investigation (FBI) on_this date and b6 
requested to speak to Special Agent (SA) b7C 
was advised of his richts orally and he thereafter b7D 


indicated that he still wanted to talk with this arent 


concerning his involvement in the illegal accessing of tne 
CTE Telemail system. 


; b6 
_ bTc 


b7D 


10/19/83 ___,, Alexandria, Virginia Alexandrie 1964-63) 


investigation on Fite # 


SA read 


ca) Q 
by : OEE Date dictated 10/21/33 b7c 


This document contains neitner recommendations nor conclusions of the FBI. it is the property of the FBI and is loaned to your agency; 
it and its contents are not to ve distributed outside your agency. 
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7 oe FEDERAL BUREAU OF INVESTIGATION 
fit: 
> Date of transcription. 
eR the Alexandria Office of the == PS. 
Federal Bureau of Investigation (FRI) on this date and an 
requested to speak with Special Agent (Sa)[ 

This agent advised [__er nis right to remain oe 
silent and[ __sdJindicated that he was aware of his rishts, b7c 
mut still wished to talk with this asent corncernins flleral b7D 
accessing of GTE Telemail systen. 

b6 
b7C 
b7D 
b6 
b7C 
b7D 
b6 
b7c 
b7D 
b6 
b7C 
b7D 
oe 10/27/83 Alexandria, Virginia = §_ Alexandria 196A-633 
Investigation on_____ a sO 


s) saL__ itz 10/28/83 = 


Date dictated b7C 
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Date of transcription 


(protect identity), telephonically contacted b6é 
the Alexandria Office of the Federal Bureau of Investigation b7c 
(FBI), and thereafter provided the following information: b7D 


b7Cc 


es 


b7C¢ 


| | b7D 
provided the following information: 


es) 


b6 
b7C 
b7D 


2) 


b6 
b7c 
b7D 


Vavstinsek ee 12/6/83 a Alexandria, Virginia)  -i., Alexandria 196A-633 
Ly wee f raat Tis 


by SA DF :mb Date dictated ___12/6/8 3 


This document contains neither recommendations nor conclusions of the FB : ! and is loa [to your agency; 
it and its contents are not to pe distributed outside your agency. / 


b6 
b7C 


FD-302 (Rev. 3-10-82) @ @ 


FEDERAL BUREAU OF INVESTIGATION 
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Date of transcription 
telephonically contacted this agent 

and thereafter provided the following information: b6 
b7C 
b7D 


His date of birth is 
his Social Security Account Number is 
home address is 


also provided this information: 


and 


b6 
b7C 
b7D 


b6 


b7D 


Investigation on 2742/84 Alexandria f Va. ruetlexandria 196A~633 
A b6 
by SA gaj Date dictates 2711/84 b7c 
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Date of transcription___1/25/84 


Cd home phone[_ cg a 
telephonically contacted this agent on this date. as 


thereafter provided the following information: 


a ESE 


Investigation on____ 1/23/84 sat Alexandria, VA .._—_—_Fite « Alexandria _ 
196A-633 


» Sal s—s—~—“—t™CC mb ate aictater __ 1/23/84 ____b6 
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Date of transcription 


telephone was advised of the official identities o 
the interviewing agents and thereafter provided the following 
information: : ae 


eee well known at the WUSB Radio Station and 
is considered to be a "phone expert." During the summer of 1983, 
saw a handwritten note on a bulletin board at the radio 

Station that said something to the effect of "the phone police b6 
are comina." At one point, and were standing b7Cc 
next to the bulletin board and asked what that 
sian meant, replied something to the "I don't 
want to talk about it." ae that was continuously 
doing something with the phones that he did not want other people 
to know about. 

[aiso has personal knowledge that[ _uses b6 
the telenvhone "constantly" to make various tynes of telephone calls bic 


to 89M numbers and is much more knowledceable about unusual 
features of the televhones than other people. 


In anrroximatelv May or dune, 1983,[ sds saw 
call some sort of answering service or messeace service on the 
telenhone.[ __—__swas usinc the telephone in the radio station 
and the vhone was on a speaker at the time. saw 
punch various huttons on a touch-tone telephone and then a voice 


would sav somethine to the effect, “Press one to leave @ messace, 


two to hear 2 messaae, etc.” When saw that and ae 
others had heard this, he seemed to be verv concerned. At this , 
same time, also heard a message from to 

beina delivered over this messaqe syster. Clearl 

recoqnizea[ voice and knows that ana[ 

are oood friends. It is clear to that the message 

heina delivered on the telephone system was from to[ 


; | 
[saia that svecificaliy called the be 
"message service” to check for his messaqes. was nae 


also vresent when this happened. 


12/20/83 ——Eaeee Alexandria 196A-633 
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. According ee | moved somewhere = 
te New York. He move n August 1983. | Jhas visited 

a ee the past week. ‘ ar 

In a ximately Ma 1983,| | saw| | 

anaf ana (Last Name Unknown a pay telephone 


in the Student Union at the State University of New York Campus 

at Stony Brook. eases as dialed a 

ana[___ | said, m calling the Defense Department." 

then said that the number rang a couple of times and Shen he would 
receive a dial tone. 


On October 13, 1983, the day the premises of WUSB Radio 

Station were searched by agents of the er,[ was present 

when agents first came to the station_and he indicated 

had a search warrant. At this point, called 

to report that the agents were there because he thou computer 

in the station belonged to called 

and said something to the effect of, "The_phone lice are here." bé 

appeared very disturbed and asked what he meant. b7c 
said, ° is here and they have a search warrant 
or computers." [ |repiied something to the effect of, 

"Thanks for letting me know. There is something we have to get 

rid of or there is something we have to do." also asked 
to find out if anyone was down_in the room where the 

computer was. reported that was, in fact, 
om and asked to cal to the telephone. 
did ca to the telephone and listened 


b6 
b7C 


then_left and apparently went back to the room where 
e computer was. says he clearly got the impression 
that was asking to remove something from the room 


where the computer was. 


- After the search, | ___|cane back to[ sand said, 
"Thank you for calling me, it was important that you did that.” b6 
TC Jagain felt that[____]had succeeded in having] sd b7C 


get material out of the room to be searched before the FBI agents 
found it. 
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NAMES OF DEFENDANTS: 


1.) described as: 


Race 

ek, 

Date of Birth 

Height 

Weight 

Eyes 

‘Iowa Motor 
Vehicle Number 

Address 


b6 
b7Cc 
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Race : aL 
Sex 6 
Date of Birth [} 
Height 
Weight 
Social Security 
~ Account Number 
Address — 


(a 


a4 


b6 
b7c 


we, 
ca 
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. described as: 


Race Ae 

wex \* 

Date of Birth 

‘PISCE OF Birth b6 

Social Security b7C 
Account Numbér™ 
Address 


n5 


AX 196A-633 
4. [dt described as: 
Race lA 
Sex. yf? 
Date of Birth [| 


Social Security 
—. Account,.Number 


” 


-Address’* ae 


Soe 


Present Address 


av 
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s.[ described as: 


, Race 
of SEX an 2 
Date of Birth 
_ Social Security | 
Account Number 
be ee 
Height 
Weight 
Eyes 
Hair 
Address. 
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6. (To) ccsevitea as: 


Sex __. yy 
.Date of Birth 
Social Security 


Ss ia nieceninearameaanterecremmnse ee 
.Account Numbér™ [| __+_|— 
— eres rovided subject) 
— ACIC} — bE 


Height bic 
Weight 
Eyes 
Hair 
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PROSECUTIVE STATUS: 


1. On August 30, 1983, the available facts in this 
matter were presented to Elsie Munsell, United States 
Attorney, Eastern District of Virginia, who advised she 
would consider prosecution in the matter. 


b6 
b7C 


were searched pursuant to a duly authorized fe search 
warrant and various computer paraphenalia were seized. 


3. On October 13, 1983, the premises located at ee 
pursuant to a duly authorize ederal search warrant and ; 


various computer paraphenalia were seized. 
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WITNESSES: 


~ [| 
eL1emal 


8229 Boone Boulevard 

Vienna, Virginia 

Telephone [___] 

Can provide details of GTE Telemail operations, 
methods of detecting unauthorized users and 


procedures for obtaining print-outs of customer 
messages. 


or 
pecia gent 


4. 


Federal Bureau of Investigation 


Can supply details of investigation. 


Special Agent 
Federal Bureau of Investigation 
Omaha 


Can supe details concerning search off | 


Special Agent 
Federal Bureau of Investigation 
Tucson 


- Can a details | search of[ | 


2 
pecia gent 


Federal Bureau of Investigation 
San Diego 


Can supply details concerning search off 


eet 


30 
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b6 
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Federal Bureau of Investigation 
Albany b6 
b7c 


Can su details concerning search of 
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EVIDENCE: 
b6 
1. Summary of seven messages left _on GTE Telemail b7c 
b (original _ in possession of GTE Telemail 
). 
2. Summary of 53 items of relevance seized during 


search (in possession of FBI Alexandria). 


3. Summary of information retrieved from floppy 
discs (discs in possession of FBI Alexandria). 


4. Summary of trap and trace information received 
from b7E 
(original in possession of FBI 
Alexandria). 
5. List of charges attributable to aka b6 
[ (original in possession of R b7c 
6. FD-302 with attached list of items seized in 
search. 


b6 
b7Cc 


The other card contains the number 


followed by the name (originals in posssesion 
of FBI Alexandria). 


res Ld 


Summary of 12 messages left_on GTE Telemail b6 
eae | originals in possession offi. bic 


2. Summary of 11 items of evidence of relevance 
seized during search (in possession of FBI Alexandria). 


3. Summary of information retrieved from floppy 
discs (discs in possession of FBI Alexandria). 


4. List of charges attributable to[ | aka b6 
| | b7c 


3A 
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1. 
by 

Qs 
search 

3. 

A 


rE:L__ 


Summary of 62 messages left on_GTE Telemail 
(originals in possession of 


Summary of ten items of relevance seized during 


(in possession of FBI Alexandria). 


List of charges attributable tol aka 
(in possession of [sid 


oe 


Summary of 40 messages left_on GTE Telemail 


by[_|(originals in possession off i. 


2. 


Summary of ten items of relevance seized during 


search (in possession of FBI Alexandria). 


3. Co of trap and trace information provided 
pT ' Jroriginal in possession 
FBI Alexandria). 


List of charges attributable to[__} akaL__] 
aren (re in possession 


re: +d 


Summary of four messages left on GTE Telemail 
(originals een 


Co of first sheet of a list of names seized 
aka bearing the listing 
original with FBI 


b 
of 
4. 
‘of 
es 
by 
2. 
from 
Alexandria). 


List of charges attributable tol sid aka 


original with[ 


by 


we 


ie 


ee 


Summary of six messages left on GTE Telemail 
(originals 7° eameraaeay 


2. Co of first sheet of a list of names seized 
fron bearing the listing 
original with FBI). 
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3. Letter with enclosure sent to FBI Alexandria, 
dated January 14, 1984, by 


4. Letter sent to FBI Alexandria by[ ss dated 
January 26, 1984. 
5. 


List of charges attributable tol sf aka 
(original with P 


b6 
b7C 


b6é 
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b6 
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The following is a_summ of messages left by the bé 
illegal user using the nane[- don GTE Telemail. b7c 
The date and time of each message is provided with 

a synopsis of particularly significant messages included. 


1) August 30, 1983, 1:06 p.m. (All times Eastern 
Daylight Time) 
2) September 1, 1983, 8:44 p.m. 
* 3) September 6, 1983, 12:58 a.m. This message is to 


and the text is as follows: "Hi a 
1£ you get the chance would you please send the 
programs we discussed?" 

4) September 23, 1983, 9:09 p.m. jessage reads, 
ty ; ’ . , b6 
Hi ..welcome to Telemail. Let me know how 
: af b7C 
you like it.’ 
5) Sevtember 23, 1983, 9:26 p.m. Message reads, 
"Welcome to Telemail. Hone that you enjov the 
system. If you want to send any infec, tyre A 
at action. Type exit and vou will aqet the command 
mot There are extensive help commands. Later, bé 
6) September 25, 1983, 11:01 a.m. Message reads, bie 
: "Welcome to the company. See you at the security 
seminar in September.” 
7) October 11, 1933, 12:18 a.m. Message reads, 
“Welcome to the services. If I may be of further 
services please let me know." 
ou 4 v 
Investigation on 12/9/83 a Alexandria, Virginia rie e__Nlexarndria 19€A-633 
b6 
SA btl Date aictatea 12/79/83 b7Cc 


by 
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11/21/83 


Date of transcription 


The following is a summary of a_review of evidence 
eized in the search of the residence of[ ss —————si@S b6 
ee The following articles with relevence BIC 
to this investigation were found: 
1.) A photocopy of a page from the publication 
"80 Micro-Computing"”, dated March, 1981, with the telephone 
number 1-402-741-7733 followed by the words Telenet local 


access number. This is followed by the words @ mail, 
password = phones, user = phones. 


2. Hand-written note in a red notebook as 
b6 
follows: Bye 


3.) An envelope with the hand-written words: 
Silver Box followed by the letter A-697-1633, B-770-1633, 
C-852-1633, D-941-1633. This is followed by the words Blue 
Box and the number 2600. 


4.) A brown serap paper with the words "Admin 
Hack" followed by the words "Admin/Prime Computer". 


5.) A blue sheet of paper with numerous 800 Modem 
numbers on it and approximately 20 "Wats extenders". This 


sheet of paper also has the words "source online lists users".  b6 
This is followed by the number and the words b7c 
Delta Comm. This is followed by the number and 


the word Kremlin. 


6.) Computer print-out with a message from 
on how to hack Telenet. The hand-written words 
"try Telenet-212 99 are found on this print-out. 


b6 
b7C 


7.) Print-out with hand-written words "AHSC", 
AHSC is American Hospital Supply Corporation and this was 
one of the companies that was most often penetrated by hackers 
in telemail. 


8.) Print-out of a computer program to search for 
computer numbers. 


11/7/83 _ Alexandria, Virginia Alexandria 196A-632 


POV SEI at CNN tis a a a A at a ee Bt 


am b6 
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9.) Print-out with messages from TDK (on hacking 
Sprint codes), and others including 


on illegally accessing Autovon,; using blue boxes, and various 
Telenet accounts and passwords. 


10.) Print-out of a program to search for MCI 
telephone access codes. 


11.) A program to automatically dial various phone 
numbers, including those for Metrophone access codes and MCI 
access codes. 


12.) A print-out with a message from 
listing "dialups" for the National Institute of Health 
romputers. This print-out also ccntains a message from[_| 
eas he offers a Sprint code hacking program and 
“valid Sprint codes", 


13.) A print-out of Edunet file names. 


14.) A print-out of a message fron[ ___ 
listing various computers and connect addresses. There ts 


also 4 message from about a blue box. 


15.) <A print-out from the Osuny bulletin board 
with information about how to rig your phone for a long 
distance dialing without being charged. This print-out also 
contains Metrophone access numbers. It also contains a 
message from wherein he claims to have 70 source 
accounts. There is also a message from Mandrake concerning 
the phone company's detection of hackers. 


16.) <A print-out about phone phreaking. 

17.) A print-out with messages 
ae connect addresses of Arpanet 
out also contains messages Prom and 
Telenet accounts. 


18.) A computer print-out of a program to search: 
for computer numbers. 


i: 


19.) A print-out with a message fron[ | 


listing Metrophone access numbers. 


20.) A print-out of a program for an automatic 
telephone dialer to get MCI or Sprint access ccdes. 


PE 47 


b6 
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b6 
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21.) A print~o Security Land bulletin 
board with a message fron Jetving "Mainframe" 
numbers and passwords. This message also contains information 
on Arpanet. 

22.) This is a print-out containing Metrophone 
access codes left by 

whose residence at 
was searched on October 12, 1983. 


23.) A print-out containing a program designed to 
search for computer access numbers. 


24.) A print~out of a program designed to search 
for computer access numbers. 


25.) A print-out containing information on_how to 
ess Telenet, with a message from a hacker know 
This print-out also contains a message from 
containing Sprint codes, MCI codes and Metrophone codes. 


26.) A print-out of a type-written paper titled 
"Cheating power companies, vending machines, etc.” 


27.) A print-out with information on how to alter 
your phone to manufacture blue boxes and other devices to 
eheat the phone company. 


28.) A print~out with Telenet access numbers and 
connect addresses, including "Citibank Cash Manager" and 
"Nasa Recon". 


29. A print-out with a message from 
(aka and both of which offer 
800 numbers that can be extended to call anywhere in the 
United States and_MCI access codes. The message from 
gives the number as a contact number for his 
Modem. 


30.) A photocopy of an MCI credit card issued to 
It lists customer service number 612-544-8171 
and bears account number 
31.) <A print-out with numerous Sateleo access codes. 


32.) A print-out with numerous Telenet connect 
addresses. 


wT 28 


b6 
b7C 


b6 
b7c 


b6 
b7Cc 


b6 
b7c 


b6 
b7Cc 


AX 196A-633 4 


33.) <A paper with various 800 numbers written 
on it. 


34.) A print-out with a message in reference to 
the password to the Boystown PDP-11 Computer. 


35.) <A print-out with Compuserve and Source 
accounts listed. This print-out also lists access code 
numbers for overseas long distance lines. 


36.) <A print-out from the "Pirates Palace Bulletin 
Board" and it lists numerous Sprint codes, Telenet hosts and 
connect addresses, many of which bear hand-written notations 
such as "0.K,", "No good”, etc. 


37.) A print-out concerning "Autonet access lists". 


38.) A print-out listing "ADP Autonet Extended 
United States Access Locations". 


39.) A print-out with a list of various bulletin 
boards and phone numbers. - 


40.) A print-out with a list of numerous Sprint 
access numbers. 


41.) A print-out of a list of "Pirate Bulletin 
Boards", 


42.) A print-out with 800 numbers and extender codes, 
Sprint codes, MCI codes, and Metrophone codes. This print-out 
also contains password for a source account. This print-out 
also contains a message describing "phreaking" as a felony and 
stating that sharing information on these bulletin boards is 
“aiding and abetting". ¢ 


43. A print-out referring to the arrest of a hacker 
known as by the Los Angeles Police Department. 


44.) A print-out with ITT access codes. It also 
contains numerous MCI and Sprint codes. 


45.) A print-out of numerous Telenet hosts and 
connect addresses. 


46.) A print-out of a computer program designed to 
search for other computer numbers. 


Fg 


b6 
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47.) A print-out of bulletin boards and access 
numbers. 


48.) A piece of blue paper with a Compuserve 
account number, ID number and password. This blue paper 
also contains a source connect address, user name and 
password. 


49.) - Another sheet of blue paper with a source 
identification name and password. 


50.) A copy of an MCI bill tol sdf 


51.) A print-out with numerous Sprint codes and 
access numbers. 


52.) <A print-out with numerous Sprint codes and 
access numbers, many with hand-written notations such as 
"N. G." and "Check". 


53.) <A print-out with numerous Metrophone access 
codes. 


4b 


b6 
b7C 
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On October 12, 1983, a search pursuant to a Federal 


(featen Hanzant wag sxscused-af ‘he hone ol s 
b7C 
The "flo discs" that were seized in this search 
were examined by a_computer programmer. b6 
The following is a summary o findings concerning b7c 


information on these floppy discs: 


On the disc labelled 196-633 Sub T, 1Bl, Item 
Number 9, Number One, a program called, "Code Breaker for 
the Hayes Smartmodem" by was found. This 
is a program designed to find access codes for MCI or some 
similar long distance communication service... A program 
called "MCI Hacker" is designed specifically for finding 
MCI authorization codes. A program called "MCI FIND" is 
a list of access codes actually found by a computer. This 
was probably produced by the program called "MCI Hacker." 


b6 
b7C 


On the disc labelled 196-633 Sub T, 1Bl, Item 
Number 9, Number Two, a program called “C-SCAN" was found. 
This is a program which searches for other computers via 
the telephone. A program called “CODE/CHK”" is designed 
to search for authorization codes for long distance communication 
services. This program contains this "you are now running 
one of the most powerful computer programs to search for 
a correct authorization code on many of the different companies 
that provide long distance communication services. Use 
of this program may be against many different laws." 


On the disc labelled 196-633 Sub T, 1Bl, Item 
Number 9, Number Three, had a program called "MNET/OMT” 
was found. In this program appears to be a compuserve 
account number. A program called "SOURCE/OMT" appears 
to contain a source account number. 


Investigation on 1/13/84 at Alexandria, Virginia  -i..,Alexandria 
196A-633 
SubT b6 


by SA mbe Date dictated 1/13/84 _ ____ BTC 
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it and its contents are not to be distributed outside your agency. 


ae UI 


N 


AX 196A-633 


On the disc labelled 196-633 Sub T, 1Bl1, Item 
Number 9, Number Four, was found a program labelled "MCI." 
This program is designed to obtain MCI authorization codes. 
A program entitled "COMFAST" b 
subroutines, by is designed to search 
for other computers via the phone. A program called "SMFIND" b6 


is designed to obtain MCI authorization codes and was designed b7c 
) ai 


On the disc labelled 196-633 Sub T, 1Bl, Item 
Number 9, Number Five, appears a message from a hacker 
promising information on how to break in to a computer 
called RSTS. 


On the disc labelled 196-633 Sub T, 1Bl, Item 
Number 9, Number Six, is the program called "PAMS." This 
is a listing of other phone numbers connected to computers. 


On the disc labelled 196-633 Sub T, 1B1, Item 
Number 9, Number Seven, appears the program called "TELENET." 
This is a list of numerous “connect addresses" for Telenet 
computers. A program called "DIAL" is designed to dial 
a telephone number entered into the keyboard and then searched 
for numbers. 


; On the disc labelled 196-633 (T), IBl, TIitem 
Number 9, Number Eight, also labelled "Auto Dial Hack" is 
found a basic program that checks for authorization codes. 


On the disc labelled 196-633 (T), 1Bl, Item Number 
9, Number Nine, is found a program called "DIAL" in which 
there is an automatic phone dialing program that mentions 
telenet. 


On the disc labelled 196-633 (T), 1Bl, Item Number 
9, Number Ten, is a program labelled "TELECOM." This program 
contains assorted modem control programs. 


On the disc labelled 196-633 (T), 1Bl, Item Number 


9, Number Eleven, is found a program labelled "TERM MASTER.” 
This disc contains sorted programs to control modem dialing. 


42. 
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Date of transcription 


This report reflects a review of trap and trace 


information and ursuant to a Federal 
Grand Jur 


b3 
bTE 


Review of 


b3 
bT7E 


Review of 


b3 
the following: 


b3 
b7E 


b3 


bTE 


Investigation on___+/ 26/8 4 a. Alexandria, Va. cue» Alexandria 196A-633 
: b6 
by__. SA ga J Date dictated 1/26 6/84 4 TC 


This document contains néither recommendations nor conclusions of the FBI. It is the property of the FBI and is loaned to your agency; 


it and its contents are not to be distributed outside your agency. 


f Datue (Kev. d-1bae) 


“ 


On January 24, 
GTE-Telemail, provided a copy of the amount of money 
lost by GTE Telemail from the unauthorized use by the hackers. 


FEDERAL BUREAU OF INVESTIGATION 


<€ 


1984, 


Oate of transcriotion ly 3 l/ 84 


This document is broken down by user and by company. 


indicating totals by each user, 


Many of the hackers had two or more user names, 
therefore the following will be a summary of the above document, 


combining multiple user names 


(this summary covers the months of July, August and September 
for each company): 


USER 


Ld 


COMPANY 


AHSC 


UAW 


Maraven 


Maraven 


Telenet 


Telenet 


AMOUNT 


C21,00 
Si6.06 
$198.90 


$0.29 
$127.58 


$2.00 


$1.00 
$3.00 


$24.00 
$325.00 


$151.00 


b6 
b7c 
MONTHS 
v, August, 
eptember 
September 
b6 
August, September p7c 
July, August 
September 
September 
b6 
September BIC 
August 
July b6 
b7c 
August 


svae7L___] 


a,_Alexandria, Virginia 


investigation on 


SA 


by 


1/25/84 © 


ksfik 


Date dictated 1/2 5/ 8 4 


rites Alexandria 196A-633 
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At approximately 8:10 a.m. on Octob 2, 1983, a search 
was ex n the premises known es bé 
The following Special Agents p7c 
(SAs) of the Federal Bureau of Investigation (FBI) were present 


during the search which concluded at 10:30 a.m. this date: 


b6 
b7C 
The attached schedule lists all items of an evidentiary 
value which were seized. All items seized with the exception 
of Item #18 were_located in the southwest bedroom/office of the b6 
resid (VLB). Item #18 was found b7c 
by SA droom. The 
inventory itse was prepared by SA (RGC). 
. 
ae 
ssinton n__2OL12/ 2 es 
Investigation 0 10/12/83 at rites Omaha 196A-922 
b6 
by b7C 


This document contains neither recommendations nor conclusions of the FBI. It is the property of the FBI and is 'oaned to your agenc : 
it ang its contents are not to be distributed oltside your agency. q : ° " 


- __ This is to certify that on THEW 0, /IT 3 
a 75 4M 


Investigation, U. S. Department of Justice, at the time of 


j or the premises at 66 
b7c 


obtained the attached listed items. I further certify that 


at » Special Agents of the Federal Bureau of 


the listed items represent all that was obtained by Special 
Agents of the Federal Bureau of Investigation, U. S. Department 


of Justice. 


Signed 


b6 
b7c 
Witnesse 
eCia gen 
Federal Bureau of Investigation 
U. S. Department of Justice 


Witnesse 


U. S. Department of Justice 
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FEDERAL BUREAU OF INVESTIGATION 


1 Date of transcription 10 VA 18 /8 3 : 


At approximately 6:15 p.m. on October 11, 1983, Special 
Agent (SA) Federal Bureau of Investigation 
(FBI), presented an affidavit in support of a search warrant 
to United States (U.S.) Magistrate Richard W. Peterson, Council 


Bluffs, Iowa. This affidavit had previous n authorized b6 
by Assistant United States Attorney (AUSA) Southern b7c 
District of Iowa (SDI), Des Moines, Iowa. U.S. Magistrate Peterson 

ap arch warrant for remises known 

as 


. The warrant was executed at 8:104.m. on October 12, 
1983, by the following Special Agents of the FBI, Omaha, Nebraska: 


b6 
b7c 
The search was completed at 10:30 a.m. A copy of the 
search warrant and items seized was left at the premises since 
no occupants were present. It should be noted the side door 
to the residence was left open and access to the house was made 
through this entrance. Efforts to locate the owner of the residence 
were negative. Pottawattamie Sheriff was notified of the search 
warrant. General condition of the house was that it was in complete 
disarray. 
Three telephones were located in the residence with . w— ol 
numbers as follows: — ana 
Location Number Oo ie eo 
e a fof 1a Sueeesed 
Southwest ee | | 
i 4 bare ; 
Bedroom : - 1 | b6 
: | BIC 
‘Master a ge 
Bedroom : 
b6 
b7¢c 
emb Date dictates _LO/17/83 
This document contains neitner recommendations nor conclusions of the FBI. It 1s (he Eroperty of the FBI ana is ‘saned to your aye cy, 


it ana its contents are Not ta be distriputeo outside your agency. 
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OM 196A-922 


. b6é 


The search warrant was returned to U.S. Magistrate 
Peterson at 10:15 a.m., October 14, 1983, at Suite 406, First 
Federal Savings and Loan Building, Council Bluffs, Iowa. 
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Date of transcription 


The following is summary of messages left by the b6 
illegal user using the oS peereaeenay - GTE Telemail. b7C 


The date and time of each message is provided, with a 
synopsis of particularly significant messages included: 


1. July 26, 1983, 6:04 a.m. (All times are Eastern 
Daylight Time) 


2. July 26, 1983, 1:55 p.m. pomecaas Day Light Time) 
This message is from to Phalse and the 
subject is "The first atomic bomb explosion). This py6 
message is an extremely lo ssage that purports pb7c 
to be a true story told = asa (7 Laura Fermi, 
widow of the nuclear physicist, Enrico Fermi. This 
message mentioned "We lived in Hyde Park which is 
a suburb of Chicago." 


3. August 3, 1983, 4:28 p.m. This message inquires 
about an ADS System in Chicago. 


4. August 5, 1983, 2:48 p.m. This message is in 
reference to publication of the 2600 Magazine. 


5. August 8, 1983, 12:26 p.m. This message states 
in part "I got a phone call here at home Sunday 
morning from the Sysop of Osuny. This message 
also indicates that the Sysop of Osuny spoke 
with[—~—=—=—~—=—~—~—~—sidon’ the: phone.“ It appears that 
The Sysop of Osu may have the hom ne b6 
numbers for both oS b7C 
a 


and 


6. August 9, 1983, 12:22 a.m. This is another message 
concerning a phone call from the Sysop of Osuny. 


pitied igh gee 2 a7 088s eg Ke, Dl Gnanded ae Vat aE ayy, A LeRAneE ee 
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b7C 


b7Cc 
Phone 
January 26, 1983 
Federal Bureau of Investigation 
300 North Lee Street - Room 500 
Alexandria, VA 22314 b6 
. b7C 
Dear[__ 
This letter is in reference to your various phone calls to me regarding the 
investigation you are conducting. I was happy to speak with you, and I gave 
you all the information I have available, which was very little. When you 
have called, you have kept insisting that there was something I knew further 
about the case. 
You have allueded to various coincidences which seem to convince you that 
Iam the you seek, Today you suggested I was aD bé © 
b7C 


I would simply like to point out that you had no comparisons to draw at all 
until you called me the first time and I voluntarily told you much about myself. 


Because I do volunteer work for the library at the radio ‘station called CRIS 
(Chicago Radio Information Service) you found a connection to 

Because some freak picked up on my BBS phone line several months ago, and 
then disseminated my number to his friends to hassle me, you found a conn- 
ection ? as 


b6 
b7c 


When you first called me, you did not even have my correct name, and you 
asked for "R, Benedict" which was my deceased godmother's mame, a fine 
older lady who lived here for many years. I told you my name, and_I gave you 
what information I could. I told you that if there was one call for 
there were fifty of them over the course of the summer. In each and every ie 
case I told the caller, "SORRY, WRONG NUMBER." I told you of one such —- 
caller who called 2-3-4 times from Texas. (he said) who asked for 
new number,..etc... I told you this person had some terrible sound in 
his nose all: the: time he talked. _lthink.Talso told you that when I first started 
a3; At: ‘gottrashed: something awful by the same person(s) 


You pointed out a coincidence along the way that on_one of the IBM systems in 

your investigation some person used the password I do not know b6 
what to make of this, and while I might agree that there are various things you. b7c 
mentioned which have similarities to my own life, I simply cannot and will 

not assume responsibility for anything someone does that happens to look like 
something about me. 


b6 


Now, just by coincidence of course, two — after you spoke to me the first 
_b7c 


time, I gota piece of mail for your It did not even have the 

correct address/apartment number (we have no such number as whatever it 
said). I forwarded this to you without hesitation - unopened - if it would help 
you. ITadded a note saying that of all the times there had been attempts to contact 
this person, it was the first time someone had bothered to write. I have attempted 
to be cordial in our phone conversations, but I do not like your repeated insinuations 
that I will be inalot of trouble, be forced to come all the way to Virginia, etc. 

I have never hesitated to talk to you, even though on both ocrassions that you 

called me I had just gone to bed from an overnight work shift. 


You are free to tap my. phone and dont need my permission. You are free 

to compile all my phone records. If you think you can uncover some big 

secret out here you are welcome to have someone come and visit... Don't 

even tell me - just surpirse me at 6AM or something. I don't really care any 
longer as longas you will please conclude your investigation where Iam 
concerned. My mistake, I believe, was in not getting my phone number changed 
back in the summer some time after I took down the BBS from my line. If these 
freaks or whatnot have passed my number around there is not one thing I can do 
about it. 

You also noted that Ihada post office box. Yes Ido and have had for many years. 
It is actually registered for this building I think and not just for my use. You 

kept talking about Hyde Park New York, or Chicago. 


b6 
b7C 


was supposed to be some other coincidence of yours. Believe me, no one who 
values their life lives in Hyde Park, a south side ghetto here, No I guess you 
dont believe anything I say. 


You seep asking where I was teaching school.. lam nota school teacher, Iam 

not competent to teach much of. anything, and I was not teaching anything last 

summer. or any other time. .You made.a- hig. thing. of me having some kind of 
with. the ‘phone: trted. to oxtintnnio you thefts November. Atwo 


- 


Believe me, sir, I intend absolutely no dis respect for your office or your 
investigation, but there is nothing further I can tell you except to continue 
repeating myself as Ihave done. 


If you persist that I must come to Virginia it will work a very bad hardship 
for me. I have little money, and none to spare for travel, etc. I will lose 
time (and money) from work. Iam already indebted at work and just keeping 
afloat, due to a theivery here in June for which I was held accountable because 
of careless handling of the office money. (Sneak theif while my back was™ 
turned), Iam just now finally getting that money, almost two thousand dollars 
paid off to the owner. I live from one two hundred dollar paycheck to the next, 
If I had to come over there, there is no way I could even buy the ticket right 
now, 


May I offer what I hope will be satisfactory to you? I will submit toa lie 
detector test by anyone you choose. It could be your Chicago office. I will 
also answer anv questions a grand jury might want to ask, and possibly this 
can be notorized or something in your Chicago office. 


Iam not trying to avoid you inanywa but there is nothing: further I can 

tell you = ee Tam: nat these: people and 

I do not know these people. Iam tired of being harrasaed' by-peopte looking 

for them, and Ido not want more mail coming ran i isa.I do not 

like the repeated insinuations about trouble for myself. I cannot even afford ~ 
anattorney for advice regarding this letter but Lam. trying to write you ina 

frank and honest way, I want to clear myself immediatly and with no further 
delay. Ido not know any of the other names you mentioned, ‘except that the 
name[_ | stood out, I remembered the fellow in Texas*using that mame. be 
This whole matter has me very upset and frankly because of my financial bic 
situation at present Iam thinking maybe I will sell the computer and forget 

about the BBS since its only a hobby for me anyway. I would not even have the 
money to buy a computer these days -- I did a couple years ago when I first 

got it. 


If there is ANY THING further I can do, please let me know, but I sure want 

to clear myself if possible right her e through your Chicago office for the 
reasons mentioned. Iam sending this to you by registered mail to insure that 
you personally get it, and hope to have a reply from you shortly. I do appreciate 
your efforts but I have nothing to do with your problem. Permit me to clear 
myself if you are so suspicious of rhe. Thank you. 


Sincerely yours, 


PS -- 


I talked just a few minutes ago tof . 


He says he told vou about being on the BBS run by 
[~~ Jar the Library, Zu ek Seen By ME) 
He says he also told of how_those freaks almost wrecked my other BBS 


when I was running it with, (Think BBS). (Was on other phone line) 


He mentioned several names to you of those people.. b6 
b7c 


b6 
b7C 


all of whom are a bunch of young kids who like to destroy anything someone 
else starts. 


Also he said you asked mx about "all my phone lines.." 


Thave 3 lines 


b6 
b7C 


The first is for our office in the apartment building. The s¢cond is more-for 
outgoing calls (it has a call pack) we use it both in: nthe offtee: ‘and for me. 
Also used by xmxx janitor, etc. . a re 


The third used to be for me privately, now its the “BBS T operate after the 
fools trashed my other thing, 


If there is anything further at all let me know. Can TI takea lie detector test? 


L b6 


b7C 
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On January 24, 1984, 
GTE-Telemail, provided a copy of the amount of money 
lost by GTE Telemail from the unauthorized use by the hackers. 
This document is broken down by user and by company. 


b6 
b7Cc 


Many of the hackers had two or more user names, 
therefore the Following will be a summary of the above document, 
indicating totals by each user, combining multiple user names 
(this summary covers the months of July, August and September 
for each company): 


USER COMPANY AMOUNT _ MONTHS 


Cd ABSC $62.29 duly, August, 


SLeMnper 


b6 


[ Maraven Si6.00 Anagust, September p7ec 


b7C 


3.00 

[ Maraven $24.00 August 

Telenet $325.00 July b6 

b7C 

Telenet $151.00 August 
08 PL ___] 
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GTE Telemail. 


The following is a_ summa of messages left by the 66 
illegal user known as[— and] Jon - 


The date and time of each message is provided with a 
synopsis of particularly significant messages included. 


1) August 30, 1983, 12:57 a.m. 
2) August 30, 1983, 1:07 a.m. 
3) August 30, 1983, 1:12 a.m. 


4) Augu 30, 1983, 1:18 a.m. This message is from 
"Kéybis" tol __} The message reads, "Through b6 
the airport?? You think a kilo would be a bit b7¢c 


obvious. I know John Delorean, ya know." 

5) August 30, 1983, 1:30 a.m. This message reads, 
"What happens when the dogs eat my leg??" 

6) September_1, 1983, 5:12 p.m. This message reads 


"Hello and anyone else reading this text. b6 

that hoochie is 100%! I've already gone through bic 

half what I bought. I'm gonna save the rest and buy 

another. Anyone interestec in trading MCI nodes and 

codes?” 

7) September_8, 1983, 10:27 p.m. This message reads in 

part, | ‘as of 7:30 this evening, I have not bé6 

" b7C 


heard anything on our 'shipment'. 

8) September 8, 1983, 10:30 p.m. This message reads, [| 

‘I let our computer phone number search program run for 

about three hours tonight. All I got was a shit load 
of Telenet accesses. Ah well call me huh?" 

9) September 10, 1983, 11:21 p.m. 

10) September 10, 1983, 11:24 p.m. 

11) September 13, 1983, 12:53 a.m. 

12) September 21, 1983, 12:07 a.m. 
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Date of transcription._12/172/83 


The following is a review of evidence seized 
pu rrant conducted b6 
at on October 12, 1983. b7Cc 
The following is a summary of the evidence that is 
relevant to this investigation: 


(1) 


(2) 


(3) 


(4) 


A brown heav aper envelope that was 
1 ; 


b6 
b7C 
1s also known as 

A packet of white sheets of paper stapled 

together. On the first sheet is 

[ ]eollowed by the number 

On the second page of this item is the name 

nd r b6 
From b7¢c 


this same sheet of paper is a number 


[ana numbers 1, 123, and the 
password * This phone number is 


the modem phone number for 
and the numbers and password are_the 
account number and password for 

on that bulletin board. 


This item is a scrap of greenish paper containing 
numerous telephone numbers. On that sheet of 
paper is the word "Mail" followed by a dash 

and the word "Phones" followed by another 

dash and the word "Phones" again. That 

sequence of words allows a person to get 

every Telenet dial up number from the Telemail 
System. 


A scrap of white paper with four telephone bé 


numbers on it. Also _appearin n the sheet | 7 
of paper is the namel bic 


Investigation on___ 11/15/83  at_ Alexandria, Virginia Fite «_Alexandria —_—_ 


196A-633 
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(5) 


(6) 


(8) 


(9) 


A ite paper with the number 
written on it. 
A_computer print-out that came from. 
bulletin 
oard. Ss message is from 
L | : 


and it is about the ITT 
ialcom Network. In this message, 
leaves an ITT Dialcom account and 


password. also says he has 
about seven other accounts on ITT Dialcom. 


A computer print-out_from 

bulletin board from n this 
message he gives the telephone number for 

the University of Kentucky computer and gives 
you a log-in code. ne leaves 

five source accounts with the instructions to 
dial up Telenet and stating that you can access 


the source system by hitting "C" then a space 
then "30128" on your keyboard. This_message 


is followed by another message from[ _| 
era | which he ilsea ae 
east main frame computers and their 


telephone numbers. Examples of the computers 
are Michigan National Bank, University of 
Hartford, Charge Card Association, Michigan 
Bell. 


A print-out of a “telephone modem search" 


(10) A photocopy entitled, "Local Telephone Numbers 


for Access to the SPRINT Network." 


(11) A computer print-out entitled, "How to Cause 


Car Trouble." This lists numerous things 
a person can do to damage an automobile 
such as "Pour Draino in the radiator. 

Pour sand in the crank case," and numerous 
other methods for damaging someone's car. 


4" 


b6 
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1/16/84 


Date of transcription 


a computer programmer, examined 
various "floppy disks" that were seized pursuant to a bé 


Federally approved search warrant at the residence known b7c 
as This is the 
residence o an is parents. 


[____————_sdjfound the following information of Pe 


interest: b7c 


On a floppy disk labelled 196-633-Sub I 1Bl, 
Item Number 3 (one of eight), Number 1, the following 
information was found: Under a heading "OMNICOD/BAS" appears 
a program that searches for access codes to computers 
or long distance networks. Under a heading known as "SPCODE/BAS" 
appears a program that will break MCI "access codes" or 
other similar services. A program labelled "SPTRVCD/BAS" 
appears to also attempt to break long distance access 
codes. A program known as "COMFIND" searches for other 
computers via the phone. 


On the floppy disk labelled 196-633-Sub I, 1Bl, b6 
Item Number 3 (two of eight), Number 4,[___————_—founa pyc 
the following programs: "Code Breaker for the Hayes Smartmodem". 
This program tries different access codes for a given 
phone nubmer, probably to get access codes for a long 
distance service like MCI. 


A program known as "Breaker/BAS" is a program 
similar to the one above, but slightly more sophisticated. 


A program known as "Break/BAS" appears to be 
an earlier version of "“Breaker/BAS". 


On the disk labelled 196-633-Sub I, 1Bli, Item 
Number 3 (one of eight), Number 3,[___—_—sd|found the bé 
following: A program labelled "Message/TXT". This is — 
a listing of various messages left on a home bulletin 
board set up by The program known as "Member/DAT" 
is a listing of various people authorized to ee 


"bulletin board". 
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On the disk known as 196-633-Sub I, 1Bl, Item 
Number 3 (one of eight), Number 2,[ _—_—siJfownd a program 
labelled "PHONE/TXT". This is a listing of messages from 
the Osuny bulletin board. 


On the disk labelled 196-633-Sub I, 1Bl, Item 
Number 1, Number 4,L_______—i|found a program labelled 
"COMPROG/BAS". This is the beginning of a program to 
search for other computers over the phone. On the program 
labelled "CODE" appears a program to find codes for services 
like MCI. also found three programs labelled 
"COMV3/BAS", "COMFIND/BAS", and "COMMFID/BAS", all of 
which are programs to search for other computers by the 
phone. The program labelled “"TRAVCOD" is the same program 
as the previous one labelled "CODE". 


On the floppy disk labelled 196-633-Sub I, 1Bl, 
Item Number 1, Number 6,._____—'|found the following 
programs: A program labelled "“COMV41" which is a program 
for searching for computers by phone. A program labelled 
"FINDINGS" lists the results of the program produced by 
"COMV41". A program labelled "MCIV41" searches for MCI 
access codes. A program labelled "MCIFIND" lists the 
results of the above program. 


On the floppy disk labelled 196-633-Sub I, 1Bl, 
Item Number 1, Number 8,[ _—_—si(ifound the program "“RUSERS/LOG". 
This program lists various users from a home bulletin 
board. 


On the disk labelled 196-633-Sub I, 1Bl, Item 
Number 1, Number 13, found a program labelled 
"FINDINGS". This program lists the results of a computer 


search program, apparently from the previous program labelled 
"COMV4L". 


a 


b6 
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On January 24, 1984, 
GTE-Telemail, provided a copy of the amount of money b6 
lost by GTE Telemail from the unauthorized use by the hackers. b7c 
This document is broken down by user and by company. 


Many of the hackers had two or more user names, 
therefore the following will be a summary of the above document, 
indicating totals by each user, combining multiple user names 
(this summary covers the months of July, August and September 
for each company): 


a TISER COMPANY AMOUNT MONTHS 
[ AHSC $62.29 July, August, 
September 
UAW $31.00 September 
; b6 
[| Maraven $16.00 August, September p7c 
Telenet $108.00 July, August 
[ BMW $0.2 September 
$127.58 


. . . . . . * . . . . . . . ° . ° . . . . . e . * . . . ° . . . ° . . 


Co cRor $2.00 September bé 
b7c 
[ RADA $1.00 September 


[i Maraven $24.00 August b6 


b7C 
Telenet $325.00 July 
Telenet $151.00 August 
S vis £ 
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The following is a_summa messages left 
by the illegal user known as on the GTE 
Telemail system. The date and time of each message 


is provided, with a synopsis of particularly significant 
messages included. 


1.) July 7, 1983, 8:49 PM (all times eastern 
daylight time). 


2.) August 17, 1983, 12:26 AM. 

3.) August 83, 2:50 PM. This message 
reads, “Are you serious What's this younger 
generation coming to.” 

4.) August 17, 1983, 5:20 PM. 

5.) August 18, 1983, 5:48 PM. 

6.) August 15, 1983, 7:16 PM. 

7.) August 17, 1983, 7:35 PM. 

8.) August 18, 1983, 7:54 PM. 

9.) August 20, 1983, 8:31 PM. This message 
reads, "Did you know that 202141 is the same as Telemail? 
I didn't." 

10.) August 24, 1983, 6:52 AM. 


11.) August 27 83, 12:44 AM. This message 
is to[___Jand is signed 


12.) August 27, 1983, 4:45 AM. The content 
of this message indicates that[ first 
name is[___]and that he knows the home phone number 


to the hacker known as This message also 
indicates that this person talked to the manager of 

a computer system and threatened to damage their computer 
system. 


b6 
b7c 


b6 
b7C 


b6 
b7c 


b6 
b7C 
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13.) August 27, 1983, 6:13 AM. 
14.) August 27, 1983, 2:46 PM. 


15.) August 29, 1983 


is from sesame cree ean Pa 


4:03 PM. This message 
The message reads 


as follows: You may want to change Be 
the PWD until cools off. I dign’+ REG my Bie 
user name, but I'd like one. Signed 

16.) August 29, 1983, 8:04 PM. 

17.) August 29, 1983, 10:03 PM. 

18.) August 31, 1983, 1:51 PM. 

19.) September 1, 1983, 4:13 AM. 

20.) September 3, 1983, 2:34 AM. 

21.) September 4, 1983, 4:46 PM. 

22.) September 4, 1983, 4:59 PM. 

23.) September 6, 1983, 3:51 PM. 

24.) September 7, 1983, 2:45 AM. 

25.) September 6, 1983, 7:31 PM. 

26.) September 6, 1983, 3:54 PM. 

27.) September 10, 1983, 1:30 AM. 

28.) September 10, 1983, 2:31 PM. 

29.) September_1ll, 1983, 4:00 AM. This 
message reads i (not the original) 
who runs is a phreak. Nothing b6 
special." is the home bulletin board b7Cc 


run by 
in this matter. 


who was a subject 


30.) September 13, 1983, 2:51 PM. This 
message reads in part, "There's no telling how long 
this will be up, but I have been on here for about 
a year with no problems." 


alo 
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31.) September 13, 1983, 11:21 PM. This 
message reads as follows: “The people at Telenet will 
know we're here sooner or later and they may or may 
not get angry; so don't post things that give your 
name or number and you may want to use a node other 
than your own. Some phreaks loop their calls all over 
the U.S.* 


32.) September 14, 1983, 3:25 AM. This 
message reads in part, “We_are not the only phreak 
people on the system, and[_____—Jgot_ the FBI after 
him by deleting Nasa‘s major node." The message also 
contains the sentence, "I was also a member of both 


PHA and Innercircle and am now a member of Securityland.* 


This message also contains the PS: “All this talk 
about who I am (sic) because I can see how great this 
would be if I worked for the FBI." 


33.) September 14, 1983, 10:37 PM. This 
message is from tof ___ana reads, 
"Hil }.Well I also have been hacking on Telenet 


for quite a while (not as long as you) and this is 
not my only T-mail admin. This group is not really 


mine but I adopted them because I plan on dumping Telemail 


soon anyway (very strong rumors that Nasa had some 
major trouble and had the FBI on Telemail). For this 
reason I won't give away anything else, except that 

if you can get onf 

Quite a project if you're government. I'd also like 
to say that I left everything open here on purpose 
figuring that if Telenet was looking for me they would 


find me otherwise I don't care who sees 
have more private groups though. Signed " 


34.) September 14, 1983, 10:42 PM. This 


message is from Admin/SCPP/Bang/Promo/Raytheon to SCPP. 
Subject is: Text of the message is "I 
am and my address is[ sid ® 


35.) September 15, 1983, 1:29 AM. This 
is from Admin/Promo/Raytheon to SCPP, subject "Also 
Text of the message is "I am also The 
-Only in a more powerful state." 


q"\ 


board you can contact me there. 


b6 
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36.) 
37.) 


message reads as follows: 


September 15, 1983, 1:27 AM. 


September 15, 1983, 1:15 AM. 


This 


“The Telenet people can 


easily find out which node you call from; in fact, 
it will be on the bill to be sent out about now. But 
many Admins don't look for the user name or anything 


like that. Oh yes, 


38.) 
39.) 
40.) 
41.) 


42.) 


of this message is as follows: “Oh it was just a thought...I1 


September 15, 1983, 1:59 AM. 
September 15, 1983, 2:00 AM. 
September 15, 1983, 1:19 AM. 
September 15, 1983, 1:32 AM. 


September 15, 1983, 4:18 PM. 


I do not work for the FBI.” 


The text 


had heard that the FBI was looking into Telmail (SIC) 


because someone deleted Nasa and Unix...True? 
someone who told me they deleted Unix a while 
and he could well have deleted Nassa. 


43.) 
44.) 
45.) 
46.) 
47.) 
48.) 
49.) 
50.) 


51.) 


September 15, 1983, 7:49 PHM. 
September 16, 1983, 4:30 AM. 
September 16, 1983, 5:42 PM. 


September 17, 1983, 3:24 AM. 


September 18, 1983, 4:01 AM. 


September 19, 1983, 6:21 AM. 
September 21, 1983, 5:55 AM. 
September 23, 1983, 4:24 AM. 


September 24, 1983, 6:35 AM. 


Signed 


I know 


eh 


This 


message reads in part, "Ah you shouldn't have mentioned 
the Oak Industries Vax, now you'll have to hear how 
I broke in on their Vax and had them beg for mercy." 
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. The message continues, "Well it's been almost two years 
and I just got a breakthrough that will give me an 
account before too long. I don't know whether to use 
it for years quietly or destroy the Vax." 

52.) September 24, 1983, 6:20 PM. 

53.) September 26, 1983, 2:31 AM. 

54.) September 27, 1983, 2:32 AM. 

55.) September 27, 1983, 5:55 AM. 

56.) September 27, 1983, 5:56 AM. 

57.) September 27, 1983, 6:10 AM. This 
message reads in part, “When I was a member of PHA 
(Phreakers of America) and two generations of TIC (The 
Innercircle) we did all kinds of things that did nothing 
but waste time, to show that we were a group. We set 
up and took down boards, argued over different logos, 
voted members we didn't like out, etc." 

58.) September 29, 1983, 7:12 PM. 

59.) October 1, 1983, 9:17 PM. 

60.) October 2, 1983, 4:30 PM. 

61.) October 2, 1983, 4:33 PM. 


62.} October 3, 1983, 7:55 PM. 


FD-302 (Rev. 3-10-82) @ & 


FEDERAL BUREAU OF INVESTIGATION 


1 Date of transcription na 2/ 2 8/ 8 3 


The following is a review of items seized in a court 


ized search of the premises known a ae b6 
a on October 13, 1983. The following items o bic 
relevance to this investigation were found: 
1 A spiral bound notebook containing the name b6 
and the telephone number[ it b7c 
A letter from 
b6 
Some sort of a computer war game that been Jen nl bic 
are involved in. 
3 b6 
This_pos a ears to ae 
discuss a computer war game that and are 
involved in. : 
4 A_white 3-inch by 5-inch card_bearina the name 
telephone number b6 
address b7c 
_A white 3-inch by 5-inch card bearing the name 
address b6 
b7c 
6 A _ white 3-inch by 5-inch card bearing the nam 
telephone number be 
address bic 
7) A 9-inch by 12- inch water color pad with the first 
sheet of papner also bears the telephone number a 
followed by the word[ | It also has the telephone number aan 
followed by the name It also contains the 
telephone number _ The note pad_also bears the 
famel.=|fatiowed by the telephone number 
This pad_also has the name followed by the telephone 
number 
Investigation on 12/22/83 Alexandria, Virginia... Alexandria 196A-633 
Sub F 
b6 
by SA btd Date aictatea_L 2/22/83 b7c 
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8 A white sheet of paper bearing the telephone number = \6 
| | b7C 


9) A white card bearing numerous telephone numbers and 
a dial up number and access code for Ditt DialCom Computer System. 


10) Approximately 30 sheets of computer paper stapled 
together and labeled RDF Start Up Routines. 
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Date of transcription 1 / 31 / 84 


a, GTE-Telemail, provided a copy of the amount of money 
fe) 


st by GTE Telemail from the unauthorized use by the hackers. bye 
This document is broken down by user and by company. 


Many of the hackers had two or more user names, 
therefore the following will be a summary of the above document, 
indicating totals by each user, combining multiple user names 
(this summary covers the months of July, August and September 
for each ‘company): 


USER COMPANY AMOUNT MONTHS 
———y* AHSC $62.29 July, August, 
September 
UAW ; $31.00 September 
: b6 
[| Maraven $16.90 August, Seotember p77 
Telenet — $108.90 July, August 
Cd. pot $0,29 September 
$127.58 


[ CBOT $2.00 September b6 


b7Cc 
ey RADA Si iar Ceeetentes 
$3.00 
[| Maraven $24.00 August b6 
b7c 
Telenet $325.00 July 
Telenet $151.00 August 
Svs F 
faseuaancs 1/25/84 a_Alexandria, Virginia rue e Alexandria 196A-633 
. b6 
= SA :sfk Hates 1/25/84 b7C 
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The following is a 
illegal user using the names 
C4] on GTE Telemail. 


FEDERAL BUREAU OF INVESTIGATION 


summar eft b 
and 


- Date of transcription 1/4/84 


the 
b6 


b7C 


The day and time of each message is provided, with a 
synopsis of particularly significant.messages indicated. 


24. 
25. 


This message reads 


July 10, 
July 16, 


1983, 
1983, 


5:33 p.m. 
12:32 a.m. 


August 2, 1983, 7:06 p.m. 


August 
August 
August 
August 
August 
August 
August 
August 
August 
August 
August 


Sr 


1983, 


1983, 


1983, 


2:46 a.m. 
8, 1983, 10:08 p.m. 


10:01 a.m. 
11:00 a.m. 
10:46 p.m. 
6:39 p.m. 
12:40 a.m. 
12:46 a.m. 
12:54 a.m. 
1:02 a.m. 
9:32 p.m. 


September. 3, 1983, 10:49 p.m. 


September 
September 
September 
September 
September 
September 
September 
September 
September 
September 


4, 
10, 


1983, 
1983, 
1983, 
1983, 
1983, 
1983, 
1983, 
1983, 
1983, 
1983, 


"Does 


7:02 p.m. 
7:18 p.m. 
7:31 p.m. 
11:16 p.m. 
11:08 p.m. 
11:17 p.m. 
11:37 p.m. 
11:05 p.m. 
11:09 p.m. 
11:12 p.m. 


anyone think we will be better 


off if we made a separate phone call for each connection to tele- 


mail? 


Would that make us look more like the real thing?" 


Investigation on____12/8/83 s_—sat_ sd Alexandria, Virginia rile «Alexandria 196A-633 


kh 12/8/83 b6 
by_SA g Date dictated iT 
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September 16, 1983, 8:17 p.m. 
September 18, 1983, 2:09 a.m. 
September 19, 1983, 12:24 a.m. 
September 19, 1983, 11:44 p.m. 
September 22, 1983, 10:45 p.m. 
September 26, 1983, 9:12 p.m. 
September 28, 1983, 7:44 p.m. 
September 28, 1983, 7:45 p.m. 
September 28, 1983, 8:39 p.m. 
September 29, 1983, 11:28 p.m. 
September 29, 1983, 11:48 p.m. 
October 1, 1983, 7:35 p.m. 
October 2, 1983, 9:51 a.m. 
October 2, 1983, 11:35 p.m. 
October 9, 1983, 12:21 a.m. 


\ws 
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FEDERAL BUREAU OF INVESTIGATION rs 


12/5/83 


Date of transcription 


The following is a summary of the review of seized 
evidence obtained pursuant to a duly-authorized Federal search 
warrant executed on October 12, 1983, at the. residence of bé6 
b7C 


The following is a summary of the evidence that 
is relevant to this investigation: 


1. A computer card bearing the number 800-424-9494, 
with the word "telenet” written underneath it; 


2. A computer card with the words[___Jand 
written on it: also written on this card are the b6 


words "cbhot", "scannet", “dialcom", and "tymnet"; b7C 
this card also contains the word[ 


3. This item is a yellow sheet of paper with numerous 

phone numbers associated with bulletin boards; also 

found on this sheet of paper is the number 

followed by the word "Voice" and the name Pee 
this sheet of paper also bears the address 

it also contains 

followed by the telephone 


number 


4. A white sheet of paper bearing numerous phone numbers, 
some of them identified as follows:| SS 
. ; b6 
This _paper also contains the name bIC 
and_the number[— I and the name[___|and the 
number 
5. A message addressed tol 
Cd dated 6700-EN, September 15,1983. 
and in the remarks section b6 
called. Be on campus 9:00 b7c 
Number “On the 
back of this message are the words and 
Investigation on___ L/15/83 a Alexandria, Virginia cuelexandria 196A-633 
b6 
pny SAT —“—™C™SCstSK ate dictates 22/15/83 b7C 
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6. 


10. 


2 


White sheet of paper with the name = ; 
[dd It also contains the name 
is sheet 


of paper also contains the name and 


and next to that the word 


A white sheet of computer paper with the word "Black" 
"800-523-0684". This sheet of paper 


and the number 


also bears the word 


by hackers; 


"NASA", "ARC", "JPL". These 
are all host companies on telemail that were penetrated 


A white sheet of paper bearin = 


". This sheet of paper also has the words telemail 


check; 


A white sheet of computer print-out paper that has 
numbers listed for ITT, Metrofone, Telenet, Sourcenet, 
Sprint, followed by what appeared to Sprint access 
codes; Allnet and two 800 numbers; 


A sheet of computer print-out paper 
followed _ by the words 


i followed - _ word 


word Maraven 
[| ana 


hal 


ul 


hee 


f 


er also has the words 
and 


\\0 


b6 
b7Cc 


b6 
b7C¢ 


 b6 


b7C 


FD~$U2 (Rev. 3-10-32) - . 


FEDERAL BUREAU OF INVESTIGATION 
Oate of transcription l/ 31 VA 84 


On January 24, 1984, 


[___} GTE-Telemail, provided a copy of the amount of money b6 
lost by GTE Telemail from the unauthorized use by the hackers. BIC 


This document is broken down by user and by company. 


Many of the hackers had two or more user names, 
therefore the following will be a summary of the above document, 
indicating totals by each user, combining multiple user names 
(this summary covers the months of July, August and September 
for each company): 


USER COMPANY AMOUNT MONTHS 
[ ASC $62.29 July, August, 
September 
UAN , £31.00 September 
. b6 
[| Maraven $16.00 August, September b7c 
Telenet $108.00 July, August 
[sd BMW $0,29 September 
$127.58 


. . . . . . . . . . . e . . . . . . . . . . . . . . . . . . . . . . . 


[ CBOT $2.00 September b6 


. b7C 
Cd RADA $1.00 September 
$3.00 
[| Maraven $24.00 August 
b6 
Telenet $325.00 July — 
Telenet $151.00 August 
Investigation on 1/25/84 a Alexandria, Virginia rie e Alexandria 196A-633 


b6 


by SA ksSfk Date dictated 1/25/8 4 b7c 
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i 1/4/84 


Date of transcription 


The following is a summary _of mes s left 
by the illegal user using the nane| Jon GTE ae 
Telemail. The date and time of each message is provided, nie 
with a synopsis of particularly significant messages 


included. 
1.) August 15, 1983, 12:17 AM. 
2.) August 15, 1983, 12:24 AM. 
3.) August 18, 1983, 1:18 AM. 
4.) August 19, 1983, 12:18 AM. 
cbdatatianae 12/8/83 a Alexandria, Va. ciieexandria 196A-633 


b6 


SA gaj Date dictatea 22/8/83 7c 


by 
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Date of transcription lL £ 3 1 A 8 4 


On January 24, 1984, bé 
Lee GTE-Telemail, provided a copy of the amount of money p7c 
lost by GTE Telemail from the unauthorized use by the hackers. , 
This document is broken down by user and by company. 


Many of the hackers had two or more user names, 
therefore the following will be a summary of the above document, 
indicating totals by each user, combining multiple user names 
(this summary covers the months of July, August and September 
for each company): 


USER COMPANY AMOUNT MONTHS 
....._] AHSC $62.29 July, August, 
September 
UAW ; $31.00 September 
> b6 
[ Maraven $l6.00 August, September b7c 
Telenet $108.00 July, August 
[es BMW $0,29 September 
$127.58 


. . . . . . . . . . . . . . . . . ° . ° . . . . . . . . . . . ° . . 


[ CBOT $2.00 September b6 


b7C 
Cd RADA $1.00 september 
$3.00 
[sd Maraven $24.00 August 
\ Telenet $325.00 July ; b6 
: b7c 
Telenet $151.00 August 
ee ee ea 
Investigation on 1/2 5/8 4 Si at _Alexandria, Virginia fie * Ale exandria 196A 1 9 6A~6 3 3 
oy SA pSfk Date aictatea__ 1/25/84 = BE 
; b7C 
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FD-302 (REV. 3-8-77) ; , . , : 
O G . 


i Date of vaneciptowsuee 7/15/84 


ng is_a summary of the activities 
of akal on GTE Telemail. 
| using the alies| aa was Bue 

an illegal user In three ceerseeae elema companies 


as follows: 


‘ 
AMERICAN HOSPITAL SUPPLY COMPANY (AHSC) 


RADA COMPANY S 
MMM COMPANY 
is known to have left at least ten 
messages on the GTE Telemail System from August 31, 1983, b6 
to October 11, 1983. b7C 


In late September, 1983,[ began "welcoming" 
new illegal users to the telemail system. 


On September 20, 1983, September 21, 1983, 
September 22, 1983, September 23, 1983, and again on 
September 24, 1983, the GTE Telemail security log detected 
a hacker attempting to break into forty different legitimate 
telemail administrator accounts. All of these calls came from 
the 402 area code and into telenet dial-in number 
Trap and trace records received from 


b6é 
b7Cc 
b7E 


Investigation ie PIO/BU 2 at __ Alexandria, Virginia File. # Alexandria 196A-6 3 3 
Sub T 


b7Cc 
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ee 


Date of transcription I 0 L l 8 L R 3 


male 
cted 


a 


i 
conta 


On October 13, 1983, 


[telephonically 


identifying himself as 
the Omaha office of the 


Federal Bureau of Investigation (FBI) ted that he was sé 
at that time in San Diego, California. continued that 
3 . os b7C 
he had been informed that his residence 
had been "ransacked," and that "some piece of paper" had been 
left at his house. 
was informed that his home had been searched 66 
on October 12, 1983, by Special Agents ‘SAs) of the FEI, pursuant - BIC 
to a warrant issued by a U. S. Magistrate for the Southern District 
of Iowa (SDI), and that since no one could be found at the residence, 
a copy of the warrant and inventory cf ali items selzec by autherity 
of the Warrant was prominently attacnec to tne front of the 
regrigerater in the kitchen cf nis resictence 
[was further informed tnat his use cf the wera bé 
"“ransackea” Was inaccurate in that upon entry toa the residences, pic 
SAs nected that every room in the reslcence was in a state ct: 
total disarray. 
stated he was concerned that his professional b6 
papers had been seized and he could not conduct his business b7c 
without them. 
He was informed that stens taken were. selectively 
seized as being related to or eviden of the criminal conduct 
specified in the search warrant, Praud By Wire (FBW). 
stated he had been at his home on only four b6 
occasions during the last two months, and woncered whether some b7¢c 
"kids" may have been using his computer. 
added that his house is always open, and anyone b6 
can enter the house at any time. pwr eee eee ~ pyc 
Investigation on 10/13/83 at ha, Nebraska rile» Omaha 196A-922 
es 10/13/83 Be 
by Date dictatea b7c 


This document contains neither recommendations nor conclusions af the FB!. it is the property of the FB! and is loaned to your agency; 


it and its contents are not to be distriputed outside your agency. 


\BA 


FD-302 (Rev. 3-10-82) @ r 


FEDERAL BUREAU OF INVESTIGATION 


i Date of transcription 2 2 8 


The following is a summary of the activities 
of} on telemain. 
b6 
used the names bic 
in the companies known as RADA and MMM. 
as accessed telemail approximately 12 times from August 
30, 1983, to September 21, 1983. 
His messages include references to drug usage 


and plans for interstate transportation of drugs and to 
“trading” MCI long distance access codes. 


On October 12, 1983, admitted to accessin bE 
GTE telemail to communicate wit — 


and 


Investigation on 1/30/84 a Alexandria, Virginia rie eplexandria 
ee A- 

by SA mbe Date dictatea__ 1730/84 
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Bi Date of transcription 1 0/ 1 7/ 8 3 


mw" ae 6 ALM., on October 12, 1983, 
were awakened at their residence at b6 
at which time they were advised as to the iden es of b7C 


the interviewing Agents and the purpose for the Agents being at 
their residence. 


At 6 A.M., a search warrant w 
for the search. of his residence, 
advised his son did h uter and it was located 


in his son's room. At this time was awakened 
and advised as to the identities of the Agents and the purpose for b6 
their presence. At this time appeared to be hyperven- b7C 


tilating. [sds explained to the Agents where his records 
were concerning his computer. aes | pointed out the one. 

diskett that contained all the computer records of his f£ 
General Telephone and Electronics' (GTE) Telemail. SA 


wrote "Telemail" on the corner of this disk. 
taken to the kitchen and interviewed in the presence o 


Both and[ ______], ;were advised 
chat 2 2 subject in the investigation, 
however, there waS no arrest warrant for his arres d_ further 
that he was not going to be arrested on this ae 
was advised that he did not have to talk to the FBI, however, he was P7¢ 


asked if he did wish to be interviewed to i was 
willing to talk to the FBI. At this time 


' provided the following information: 


was then 
is father. 


Approximately two to three months past he was using his 
computer through Compuserve, a service he was paying for out of 
Columbus, Ohio. His access number in Tucson, Arizona, for 
Compuserve is[ ____—s«ie:=s This is an open line that can be used 
like a CB radio. Anyone can talk to anyone that subscribes to b6 
this service. Through Compuserve he talked to_an individual who b7C 
used the name He does not know if[———sdJwas' a true 
name or not. told him he could use GTE's Telenet system 
to send messages. told him to_dial Telenet, 747-0107 and 


then type in Telemail First account ave him was[ sit 
Later he told him his|________| account was 
b6 
He did send messages to people using the GTE bic 
Telenet System. He talked with (true name not recalled) ( Zot > 


wvetistion on LO/12/83 an [S—S—S—~S~S~Ssd eB ¢—=1OGA-1325 


SAs and 


by : Date dictatqd, 


2 aS ae a 
a <2, 
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. Page b6 
Continuation of interview of ’ = Be 


who is a male who said he lived close to Los Angeles, California. 
He located a note from his records that reflected 


telephone number as He also located a_brown 
envelope from his records that he had_received from : 
which reflected a return address of 


true name is “ie 
whose residence telephone_number is and mae 
bulletin board number is 


true name is 
note from his record reflectin 


He located a 

and address b6 
He advised b7Cc 
telephone number is 


He talked O————————————————— ne, b6 
ands over the Telemail accounts. b7c 


believes 
the codename He saw_one message in j the 
name[___|lwas used instead of codename in i ent 
he was going to Detroit for a CB conference. was always 
bragging about changing the pass words in the computer of Miter 
Corporation, Arpanet System, which is designed for research Be 
corporations. He changed the pass words because the systems Bie 
. a@ministrative caught him in the system and told him_to get off. 
In talking with on Compuserve he asked what 
happened to his accoun in that he tried to use it 
and it was not there. told him some of the accounts had 
been erased and that was trying to set up new accounts. 


true name unknown, told ‘how to 
access Telemail. In a conference call between b6 

and himself was bragging about his pyc 
use of the Arpanet System. also bragged and said that 
he had erased 200 NASA Accounts. had more knowledge 
about the Telemail system than anyone else. 

was a Hacker who used both Compuserve and 
'Telemail who he believes lives in Oklahoma City. He does not 

know the true name for[ _—itxs He sent and received messages b6 
from and through these messages said he b7C 
lived in did not live far away. In 


conversations wit 
hour of 


said he lived within an 


PX 196A-1325 


eh Ree ee . 
Contmuaton omtarvow ot [Prag 


He talked with 


talk with 
and 
to a party wit 


several people used the codename of 


He recalls seeing 


name on Telemail. 
He believes 


on Compuserve and saw 


the name 


Telemail and believes he may live in New York. 


[Ite pas 
new account for Telemail from 


He did not use Telemai (oe) 
is a friend of 


had gone 
He believes 


(codename) on 


had gotten his 
over Compuserve. 


gave him his new account, name of 

ot the new account. However in 
and[ she was told by 
them that[___————sdjhad set up the new account. 


He does not know where 
later conversations with 


He believes[ _—_—_—iwas the one who started illegally 


using Telemail. 


te him an account number 405,206 and the 


password “Bad Bo to enter 


said it was okay to use the 
any files. 


TO used_SOURCE which is a GTE Telenet System 
_and is similar to Compuserve.| _| 
of the computer in SOURCE. 


the University of Kentuck Dec Systems 


of Dec Systems 10 is 


He was on the system when 


gave him the account number and password. 


system as long as they did not erase 


erased a lot of one section 


They were aware that 


erased the system but they did not know_who 
closed all the accounts under the name 


The codename 
with the codename 
true name is 


telephone systems. 


\42 


was also used in conjunction 


was, They 


true name unknown, lives in 


and also uses 


Pp 
was telling everybody how to access Sprint and other 


b6é 
b7¢ 


b6 
b7C 


b6é 
b7C 


b6 
b7C 


b6 
b7C 


b6 
b7c 


b6 
b7Cc 


b6 
b7Cc 


b6 
b7C 
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also told people how to make boxes that 


roduced tones to access telephone systems without paying. b6 
offered these boxes for sale for $30 each. Sal b7C 
he was years old and his telephone number is 


He also advised that[____————sdjalso sent him information 6 
on how to access Sprint. b7Cc 


He did not know any of these individuals prior to the 
use of Telemail nor has he ever personally met them. He did not 
know any of these systems were being illegally used and he did not 
profit in any way from the use of Telemail. 


[is eescribed as follows: 


Race: | . bé 
Sex: b7c 
Date of Birth: 

Height: 

Weight: 

Hair: 

Eyes: 


Social Security 


Account Number: 
Residence: 


Arizona Driver's b6 
License Number: b7C 

Father: 

Employed: 


MOH. a 7 cocemgihibge 
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This is a summary of the activity of[ | BS 


[Jon GTE telemail: BTC 


used the ngnes,[ 
an on telemail. 


b6é 
using the name[_ was a member me 
of the "Inner Circle," and illegal group in the company 
AHSC, and was also an illegal user in a company called 
Raytheon, as ADMIN/SCPP/BANG/PROMO/RAYTHEON. 
is known to have accessed the telemail b6 
system, using one of the above aliases, approximately 62 bic 


times, from July 7, 1983 to October 3, 1983. 


GTE logs show that[ would access the b6 
telemail system through the dial-up and the 619 area code. 


b7Cc 
On October 12, 1983, 
b6 
. b7c 
telephone number A search of residence 
also produced an envelope with the above return address. 

On_Oc ri4 1983,[ si stated to the FBI bé 
that he was on telemail and provided additional b7c 
details of his telemail intrusions. 

ea qistneteas 1/30/84 a_ Alexandria, Virginia rie Alexandria 
196A-633 
b6 
b7C 
by SA mbe Date dictated 1/3 0/84 
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11/1/83 


Oate of transcription 


On October 13, 1983 was interviewed at 
her place of residence, 
while that residence was being searched by Special Agents (SAS) of 


the San Diego Federal Bureau of Investigation (FBI) Office pursuant P6 
to a search warrant signed by U.S. Magistrate J. Edward Harris. RUS 
was advised of the identity of the interviewing agent, 
the nature of the search and the interview, and she voluntarily 
furnished the following information: 
advised that she has been employed at the residence 
Since March 21, 1983. She further advised that she lives at the 
residence and that her job is to clean the home and take care of BE 
the seven infants. Stated that she has seen a computer in Be 
one of the downstairs rooms, however, she has no knowledge as to who 
operates the computer or what is done with it. She further stated 
that she has never seen anyone operating the computer and that, "I 
only take care of the kids and keep the house clean." 
The interview with[ was conducted in Spanish. b6 
- b7c 


investigation on 10/13/83 at [irs 8D 1968-1018-27 


ic ARCHeD INGEKED b6 


b7C 


by_. Date dictated 


fig Ae 
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Date of transcription 11 1 83 
arch was conducted at b6 


in response to a search 


b7c 
warrant Signed by U.S. Nagistrate J. Edward Uarris. A report 
regarding that search has been made. 
shortiy after the searchin rents arrived at the lLoca- 
tion af }rear old white male named , Who identi- bé 
fied himself as the brother of was interviewed. b7c 
Was Qt je_ residence at the time the Search warrant was 
executed. assisted in identifving otner individuals in 
the residence at the time. They included: 
CO vee 
b6 
b7c 
b6 
b7C 
Said that nis garcnig wers 
re hat work at tneir company, 
pnone whoien is Locatcd in the Mira 
Mesa area of Worth San Diego. tated that his father's 
name was formerly but had changed it to 
for reasons not Known to the boy. He said that his b6 
rother, did not Like the new name and maintained b7Cc 
the old. one. He Said that aLll of nis brother's 


rher’ Ss computer equipmen 
was located in his bedroom so far aS ne knew. de indieated that 


so far as he knew, his brother had paAis computer hocked up to tele- 
phone number In addition 


cuwo other numbers came 
into his home, andc__ Cid 


was asked to identify his brother's com- 
puter friends, and the only person whom he could identify was a b6é 
boy named who currently works part-time at Poway High School. 


b7c 
He was aware that his brother ‘'talks"” to other friends around the 
country about computer games and specifically mentioned the State 
of Alabama. 
AX 196A- 633 | 
investigation an 10/13/83 ie 
SD 37B-10479 
b6 
by CS 13 33 b7C 
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it and its contents are not to oe aistriputed outsice your agency. 
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b6 


b7c 
[essentially Stayed_with 5: through- 
out the search of the residence except for room in the 


basement and other basement area rooms. 


fh 


_ 


A sketch was made of the house and that sketch is main- 
tained by the Federal Bureau of Investigation. 
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Oate of transcription 


At 
Agents (SAs)/_ et —“‘(#$N Cfandd isd 
omselves tof J and SAL] 


, special 
identified 
explained to 


that rederal Bureau of Investigation (FBI) agents ae 
were golng to search that residence, and he was exhibited a copy 
of the search warrant. SA. explained to him that the items 
to be searched for included a computer and related equipment. 
He explained that those items were in his bedroom and he directed 
agents to that location. 
Following thar, SAs 
and 
arrived at the residence and commenced searcning. b6 
b7Cc 


was advised that je 2@ fo remain in 
the bedroom if he wisnéd, but his movements were’ not restricted 
ana ne could ieave if ne so tesired. 


Le oe 


in the unauthorized_computer services of the Telemail Company b6 
through “hacking”. stated he was willing to be inter- b7c 


viewed and he furnisheu tne Tollowing informa 


SAL advised flim that he was suspected of participating 


cr te 
Ow 
3 


His true given name is and ne was 
born on Vhile was Stiil a 
juvenile, his father changed his (the father’s) name to b6 
a not know whether that meant his name was b7c 
officially change r i u i 


His parents own a business known asf b6 


Which sells b7c 


He stated he does know of people who gain access to com-~ 
puter systems without authorization, but he does not do so and 
does not even have the equipment to do so. He stated he has no 
modem, but he stated that he_has had access to one which belongs 


b6 
to who lives in telephone[____s and attends b7c 
computer classes at UCSD, last used his modem about two 
and one-half weeks ago. has used his modem and has used 


SD 87D-10472 


Ay 
investigation on 10/13/83 © ut : 196B-19018-—< 3 
SeRuiLiced bé 
ae b7c 
Spite UE (afiaie 3/83 
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b7C 
his computer. He does not think 2, ae be involved in 
any illegal computer activities such as "hacking". 
SA asked him if he has ever heard of a person who 
uses the name He stated he has heard of this person P6 
but not lately. He does not think this person is from this area. ys 
was asked about the name[ sand again he 
stated he has heard of this person but has never seen anvthing b6 
“yosted"” by him. He has heard that and b7Cc 
“yirate’ discs, meaning they cory ciscs. 
ie has not heard of search warrants in connecti 
hackers being served throughout the country within the ias 
days. He did hear there was an article in Time ‘itnsazine 
there was some sort of iegai action heing taken against oe 
which is a network of computers. ‘which he stated ne nas eee 
the cast. 
SA. asked him if he neard of Telemail. nc z b6 
ne Nas DUE aS NOt Sure. wiere. Ge ented erer Bavane “oo as SS b7c 
computer system, 


sa[ asked him again ‘snere ne nad heard off ie 


and he stated ne heard that name on the "Sul << 
a computer system that is uSed £9 sost messages. He deniea 
having used that name. 


SAL |goined the interview and asked who 
is high school math teacher was, and he stated it was b6 


and he had one by the name off jana another one Oo? pyc 
He stated he nas no blacs friends whe are 1 
computers. 
b6 


Saf askea him if he is interested in contests or if 
he has any family in Texas, and he stated he does not enter contests 
and has no family in Texas. 


At this point sal departed from the bedroom where b6 
the interview was being conducted and returned a few minutes later b7c 
and the interview continued. 


[was asked several questions regardin 


tionship to an individual by the name 
Stated that the name 


someone with whom he had attended 


his rela- 


was recalled by him as b7c 
but his 


x AD 
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recollection of was not clear. Other questi were — 
posed of regarding nis relationship but those 


questions did not specifically pertain to the search nor the 
unauthorized use of Telemail Services. The results of the 
questioning regarding[___—_—sddhave been set forth in another 
report and are available at the FBI in San Diego if necessary. 


During the search of the residence at 


SsAL______jobserved a onene located ina 


e) 


small office-type space located off of the kitchen area in the b6 
residence. The telenhone had five buttons and two iines were b7c 


3 ou re rs 


active, numbers[ sand [—=«@YdS; These numbers appeared at 
TDn re Er es 


the buttons on ti . n, two ocher numbers anneared 
as outtons on_the teleénno: WUE. eared to eG iunaerive. rhe 


numbers were 


- . + 17 ior Pore) 
January Le, Loso. 
thar SQ rr aA wA eee 
we the te peewer pe whe tad 
Tv TR mee ttl = 
LHC. , DON Less > 
Vas Seized 


A copy or anu an wovenroary of tne items 
seized was provid by sip The inventory of b6 
items seized is 2 in San wicso., wnere the seized b7c 
items were taxen. 

‘ 
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erviewed at his residence, 
He was advised as to 
the identity cf the interviewing agent and that the interview 
would concern his knowledge and participation in activities, 


now commonly known as "hacking," into General Telephone Electronics 


(GTE) Telemail System. He was advised of his rights and executed 
a waiver. He furnished the fcllowing information. 


He has been "hacking" for approximately nine to ten 
months. He has always been interested in electronics and has 
built many electronic kits. Since he was very young, he nas had 
interest in seeing how things were constructed. It is only of 
recent that he has developed a deep interest in the computer 
world. 


His present Knowledge of computer tecnnology has been 
acquired actually through trial and error. He did attend a 
Regional Occupation Program (ROP) which taught computer 
programing. Due to his background, he ended up as a teacher's 
assistant in that program and was instructing other students. 
His grade average in high school would not be indicative of 
his overall ability. His grade average was low. He explained 
this was caused by him being taken out of school several times 
and traveling in the United States. He has lived in California 
off and on for many years. He has also lived in Alaska with 
his parents. 


2 


His father is self-employed and 7 ee 
Eee ee ee He cannot remember 


the exact address, but it is located in the Kearny MeSa area 
of San Diego. The father has five to six employees. The mother 
also works with the father. advised that his father's 
name is His father changed his name to 

after seeing it mentioned in a science fiction novel. 


aes reminded of a phone call that occurred 
on October , , wherein he had a conversation with the 
interviewing agent. In that conversation, he had told the 
interviewing agent that he_was in fact 


stated that he was indeed He had been reluctant 
to reveal this fact to the Federal Bureau of Investigation (FBI) 


b6 
b7c 


b6 
b7Cc 


be 
b7c 


stelhiouices MOPIATES os pig pe SDE TOSBS VOLS. 


by 
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b7C 


agents who searched his residence on October 13, 1983, pursuant 
to a search warrant. He thought the purpose of the search 
concerned another matter involving the family. He briefly 
described the homicide of an aunt, which had occurred earlier 


in the year. He advised that he now understood the purpose 

of the FBI's presence on the preceding_day as well as today. b6 
He decided to use the name or handle after calling b7C 
in on a “Bulletin Board." One of the cther party's using the 


"Bulletin Board" at the time asked him wnat his "handle" was, 
Sin he could not or would not use his own true name, he thought 
Spl 2. ude ad nove ve Wesco Eare. 


He has contacted hundreds of individuals on the 
telephone lines by using the computer as the father purchased 


a computer for him approximately nine months ago. The first b6 
computer terminal that he had was an Ace 1000. The crand name b7c 
was Apple. He had another computer before that. That unit was 


: 4 
networks in the United States was to learn more about computer: 
He simply would access a system, learn as much as he Could apnou 
it, and then contact the programmers. He frequently talked with 
programmers regarding the system. Many of the discussions he 
had with programmers regarding the systems concerned the iack 
of security. A 


One of the frequent networks that he accessed was GTE's 
Telemail System. He recalled cne account that utilized the GT 
system as that of Raytheon. He also recalled being furnished 
an administrative password called PROMO. He obtained this from 
another “hacker” named This individual was b6 


living in Colorado and frequently used the "Bulletin Board." b7c 
(ee no idea whethed| 2 Was a Male or a. female. 

Their communication was conducted on a test loop. Conversations 

could occur without using any telephone numbers. All that had 

to happen was to have individuals call in on the access telephone 


number to the Telemail System. 


Access to these telephone lines usually involved dialing 
the local telephone number for the Telemail System. Once into 
the system, a series of numbers would be dialed and the systems! 
"Bulletin Board" would be brought up on a viewing screen. As 
he mentioned earlier, most of his involvement was with the 
Raytheon account. He did access a few others. Most of the 
accounts he accessed were what he called powerless. All an 


\4> 
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individual could do in that type of account was to send and 
receive mail. There was no ability to create or eliminate an 
account. A message could be added or deleted as wished. On 


b7Cc 


occasions, he did access an administrative account. Once identifying 


the parameters of that account, he was able to set up accounts 
of a@ Lower status. With that type of account, one could simply 
make a private account and furnish it its own access code. 


He stated that he thougnt the "Bulletin Board" with 
Raytheon was for public use. Anyone could access the system 
with the proper equipment and read it. 


The identities of other "hackers" were discussed with 


[ He advised that he does not know 


The name ZO Nim 43 4 youn Lad ats 
not Know ner Last name and, aS iar is ne Knows, sne d0ces not 
have a home computer. 

He denied any deliberate effort to i es 
information involved in the computer nets. He Oommen: 
posted on the "Bulletin Board" ingicating that MC Wier's 
had become bored and had deleted units from WHatever communicati 
system they had accessed. He did not es tc doing any of the 


deletions. He advised that he had not cracked the bank comput 
yet. As far as any other computer ce eee ne has simply dee 
on the network to see what it was all about and then had anole 
Signed off. 


He wrote a letter to GTE and discussed the lack of 
security with the Telemail System. AS he Nad mentioned earlier, 
Telemail had serious security flaws. This letter was written 
circa May of 1983. GTE never responded to his letter. 


As far as the security of Telemail or any other computer 


networks, most of the low level accounts within the system have 
little or no security. Selling of passwords to such accounts 

is common. By experimentation, many of the accounts can be 
accessed simply by using one letter passwords. He has heard 

of a "hacker" or group of "hackers" who make money by selling 
the passwords to the accounts. In fact, some of these "hackers" 
have offered to create an account for a fee. They were makj 
money from the Telemail System by creating accounts. [oes] 
recalled the group's name as the "time core," or "pirates cave," 
or "pirates cove." 


“AL yA 
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b7C 
advised he sold an RCA terminal modem to 
a pawn shop for $170.60. The pawn shop is located in the downtown 
area of San Diego. He could not recall the name of the pawn 
shop. He advised that since he does not have a driver's license, 
he was transported by a friend to the pawn shop so as to make 
the deal. He would not identify nis friend during this interview. 
He advised that he would contact him and obtain the location of 
the pawn shop so as to confirm the sale of the unit. 
b6 
b7C 
Was 3180 Familiar Ltn ARPANET. He xnew 
: . . . . f 
this to be a government's system involved in research matters. b6 
he was not involved in this system. He xnew that several b7c 
universities were uSing it. He did not xnew the access code 
to get into that system. 
The following descriprion was obtained from interview 
and opservation: 
Name: 
SEX: 
Race: 
Date of Birth: 
Place of Birth: 
Address: b6 
b7Cc 


Education: 


Occupation: 
Hair: 

Eyes: 

Father's name: 


mA 4h 
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s telephonically contacted at his 
residence, - He was b6 
reminded of a conversation which had occurred between nim and b7¢c 
the writer on October 14, 1983, at his residence. That dis- 
cussion had been preceded by an admonishment of his rights. 

During that discussion, he was questioned as to the location 
of an RCA Data Terminal, also Known as a "modem". 


He advised that he had pawned the "modem" at a pawn- 
shop located in the downtown area of San Diego. He had received 
approximately $170.00 for it. He could not recall the exact 
location of the pawnshop, and he did not have a receipt showing 
the transaction. He added that a friend of his had transported 
him to the downtown area because ne did not have a drivers Lli- 
cense. He would not furnish the identity of this triena. He 
would contact his friend and obtain the address of the vawnshop 
so that the sale of the Data Terminal could be confirmed. 


He was now queried as to the results of hi 
with his friend. He stated he had a correction to m 
his previous interview. He initiaily said he had so 
to a pawnshop when, in fact, he nad sold it to his =i 
friend had returned the terminal to him and was quite concerned 


over the recent publicity concerning the searches that occurred b6é 
throughout the United States. The friend no longer wished to be ob7c 
involved with him. Said that he would voluntarily turn 


the "modem" over to the investigating agent, and that it could 
be picked up at his residence during the afternoon of October 17, 
1983. 


At approximately 1:15 P.M., the RCA “modem", Serial 
Number 001034, Model Number UP3501, along with a smail power 
was picked up at the b6 


supply and assorted connecting cables 
residence of[ int bre 


He commented at this time that he had been told by 
friends to seek the assistance of an attorney and discuss the 
facts regarding his involvement in the illegal entry into the 
Telenet Computer System. As of yet, he had not retained counsel 
and queried the writer as to what he should do. He was reminded 


-_ 
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of his previous interview with the writer wherein he had been 
advised of his rights, including the right to counsel. He was 
told the decision was his to make. He then asked what he should 
do in the event the news media contacted him regarding his par- 
ticipation in the computer fraud. He was advised by the writer 
that any contact or discussion with the media would be left as 
his prerogative. 
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10/31/83 D6 
b7C 


tele- b7D 
phone | was advised of the identity of the interviewing 
agent and that the interview concerned an investigation involving 


the penetration of the GTE-Telenet/Telemail Computer Network. 

advised he had information concerning this matter and requested 
that his identity be protected and that the information furnished be 
kept confidential. [—]turnished the following information: 


Date of transcription 


Dé 
Ib7C 
Ib 7D 


b6 
b7C 
b7D 


10/13/83 —_ 196B-1018 —/4 


Investigation on at 


b6 


b7c 
by 
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b6 
b7Cc 
b7D 


telephone who was advised of the identity of 
the interviewing agent and the purpose of the interview, provided 
the following information: 


b6 
b7C 
b7D 


ors 
its 
Investigation om LOY IA 7 BB a sy 
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Date of transcription 


hereinafter referred 


to as 
hersinafter referred to as were interviewed 

at the offices of Home Federal Savings and Loan, 12411 Poway b6 
Road, Poway, California. They were being interviewed at b7e 
the re b7D 


reside at 


telephone 
ilowing informaticn was furnished by 


tnvestigation on 


a : 
9/16/83 AG 


7 ~ 
( 
—~("CB —fe¥— ufo 
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This is a summary of the activities of Ld 
[jon GTE Telemail. 


b6 
used the names[  bTe 
and on Telemail. 
was an illegal user in the following companies: 
BMW, MARAVEN and UAW. bé 
b7c 
accessed Telemail at least 40 times between 
July 10, 1983, and October 9, 1983. 

Records of b7E 
b6 
b7c 

has admitted to the FBI that he did access b6 
the Telemail system without authorization and was using b7Cc 
the above-mentioned names. 
iivaeantianaa 2/6/84 a. Alexandria, Va. rialexandria 206A-633 
by SA aj Date dictated 2/6 OM eet cn 
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This is a summary of the activities of[ | b6 


[jon GTE Telemail. b7C 


ees Os: the name[_ sion GTE Telemail. 
He was a m er of a group known as the INNERCIRCLE and 


b6 
was an illegal user in the legitimate customer AMERICAN b7c 
HOSPITAL SUPPLY COMPANY (AHSC).[__——=sédwe ft’. « Four messages © 
on GTE Telemail between the dates of August 15, 1983, 
and August 19, 1983. 
has admitted to the FBI that he used 
the Telemail services four or five times, but did not bé 
think that someone else was being charged for the computer — 
time. stated he thought that when someone contacted 
COMPUSERV or the source, then charges would begin to accumulate. 
; 2/6/84 | Alexandria, Va. Alexandria 286A-633 
investigation on at = File #_ 
(764 
i aL ga 2/6/84 os 
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ae a ' was advised of 


b6 
the official identity of the interviewing agent and thereafter a 
provided the following information: 
He used the pc, ae the Osuny bulletin 
board during the summer of 1983. While looking at messages 
on this bulletin board,[ si was able to see a private 
message left for another party on that board. This message bé6 
was from someone using the name and the message b7c 
stated something to the effect that "you can call me at 
ee he called the number once 
to see if it was a working number and a male answered. 
[djsaid he did not say anything, but simply hung 
up. 
also said that at an electronics show 
in New Jersey he met a computer enthusiast whose first 
name wast desie he uses the name on Pe 
the Telemail system and that he would leave Bic 
a welcome message on Telemail for 
[_sisaia he used the Telemail service 
approximately four or five times and in doing so communicated b6 
and 
further stated that he did not know 
that the messages he was leaving on Telemail were being b6 
billed to another company. He thought that somehow this — 
was an electronic connection to a Source account or a 
Compuserve account and that a person would be billed through 
Source or Compuserve once you have connected with those 
computers. 
also provided the following identifying 
information: 
b6 
Date of Birth: b7Cc 
Age: 
Social Security 
Account Number: er | 
Auatiiascereas 1/25/84 a Alexandria, Va. rie@lexandria 196A-633 
: b6 
SA gaj Date aictatea__ 1/26/84 b7Cc 
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This is a summary of the activity of[_ 


[oT Jon te Telemail. ae 


b7 
[___Jused the names[__Jana[__] ° 
[jon Telemail. 


was a member of the group known as the 
PHALSERS and was registered illegally as a user in the 
following companies: BMW, UAW, MARAVEN, TELENET and AHFS. bé 


b7c 
left six messages on Telemail between 


July 26, 1983, and August 9, 1983. 


A fellow "PHALSER" told the_FBI that 
is the same person who uses the name on various 


computer bulletin_boards. A list_of hackers seized from 


the residence of bé 
contains the listing: b7c 
-This phone number is the unlisted phone number for 
[  _} also known as also 
said he saw a message on a computer bulletin board statin 
patio teeta ee eeacned at cone nunber[ +} 
The customer name and address for that unlisted one 
panberiy | 
[was contacted at that number 
d_th he is th tual b 
b6 
b7c 
at this number, but denies being 
or using the Telemail system. The personal ID 
of on Telemail was 
A fellow PHALSER states that[__———sworrks in 
"some sort of informational job, reading stuff over the b6 
i b7C 
NCIC check on[__—jrevealed three past arrests b6 
and one conviction as follows: b7C 
(764 
isienissvion bd 2/6/84 7 Alexandria, Va. rieAlexandria 286A-633 
a 
: b6 . 
SA a Date dictatea__- 2/6/84 b7C 
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| was ae contacted and a 
of the official identity of the_interviewing agent and 


the purpose of the interview.[_____——__—sdW thereafter rovided 
the following information. His date of birth is 
and he is employed as 


b6 
b7Cc 


has two telephone 
numbers, Both of these 


rs have a customer name and address of[ _—s—s—sidtg 
indicated Ruth Benedict was his mother who is now 


deceased. 


stated he has a home computer and a modem 


and a_printer. He runs a hdéme bulletin board known as 
the The number to call to contact the b6 
computer was until approximately July 1, 1983, Bie 
when he switched the modem number a 


also has a post office box number that 
he gives out to computer enthusiasts because he does not b6 


want to a out his home address. That is,[ sg b7C 


During July and August, 1983,[ _—_—iwas setting 
up his bulletin board to accept incoming calls and requested 
assistance from a friend of his named 


b6 
b7Cc 
and according to 
has a computer system, a modem, and a printer. 
said_he does not know who KE 
or are. denied any involvement in — 
any illegal intrusions into GTE telemail or any other illegal 
6% 
arsenal / M2784 at_ Alexandria, Virginia rie » Alexandria 
196A-633 
by SA fs mbe Date dictated wee EL 3/8 4 a 
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AX 196A-633 2 
activities with his computer system. [__fatso denied *b6 
any involvement with the illegal use of the IBM ADS Voice b7c 
Message System. 

[__s|dia, however, state that he_has received 
numero h alls at the telephone number|___ Jasking bé6 
for He said these phone calls began during b7C 


the summer of 1983, and the most recent was approximately 
one month ago. 


~ 


During the summer of 1983,[ __——sJremembers 


getting a phone call from someone who identified himself 
asl This person talked with an apparent nasal b6 
condition, doing much coughing and blowing his nose and b7c 
snorting during the conversation. called long 

distance tof Jana asked him for a password for his 


bulletin board. 


stated he had had some difficulty with 
the telephone company during the past few months and that 
he received an additional number from the Chicago Phone 


Company and due to an oversight by the phone company, had b6 
not been billed for this number for approximately six months. b7c 
This number, is the number he presently uses 

for his computer, and further stated that he eventually 


had to pay the phone company an additional sum of monev 
for phone calls made over the past six months or so. 


does some work at the Chicago Library 
Radio Station reading newspaper articles over the air for 
the blind. This station is known as “CHRIS," which stands b6 
for Chicago Radio Information Systems. The one of b7c 


between this acronym "CHRIS" first name of 
[was commented on by 


said he did not know and had never heard 


of the names 

and others. said he did have a book of 
user names and true names concerning his home bulletin 
board and he may have a list of nationwide home bulletin 
boards on which he wrote the true names of some computer 
enthusiasts.[______—_—sisaiid that he would be willing to 
make this information available to the FBI. 


b6 
‘b7C 
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PROSECUTIVE STATUS: 


1. On August 30, 1983, the available facts in this 


matter were presented to Elsie Munsell, United States 
Attorney, Eastern District of Virginia, who advised she 
would consider prosecution in this matter. 

1983, the premises located at 


2. On October 12, 


searched pursuant to a duly authorized court order and 
various computer paraphenalia were seized. 


aa 
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b7C 


ie 
hs 


AX 196A-633 


WITNESSES: 


= | 
‘ TE TelemalL 


b6 
b7C 


8229 Boone Boulevard 

Vienna, Virginia 

telephone [—d 

Can provide details of GTE Telemail operations, 
methods of detecting unauthorized users and 


procedures for obtaining print-outs of customer 
messages. 


7 a be 
Special Agent b7C 


3. 


4. 


Federal Bureau of Investigation 


Can supply details of investigation. 


Special Agent 


Federal Bureau of Investigation, Albany b6 
b7C 

Special Agent 

Federal Bureau of Investigation, b6 

Buffalo, New York bIc 


Can —— details concerning search off 
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EVIDENCE: 


1. Summary of messages left on Telemail b 


GTE Telemail). 


2. Summary of messages left on Telemail by[ 
[|(originals in possession off i. 


4. Summary of relevant evidence maintained by FBI 
Alexandria. 


5. Summary of trap and trace records received from 
 Mloriginals at FBI Alexandria). 
6. List of charges attributed to 
and[ sd (originals with : se 


1. eae of messages left on Telemail byl 


(originals with ). 
2. Summary of evidence retained by FBI Alexandria. 


3. Copy of_incident report from Nazareth College 
which implicates 


4. Summary of nine messages left on Telemail by 
[-—"Ioriginals with[ 


5. Co of trap and trace documents provided by 
ew Woriginal with FBT Alexandria). 


6. List of charges attributed to , aka 


[i andl aka[___——sd (original with,  _—si+io. 


\AS 


b6 
b7C 


b6é 
b7C¢ 


b7E 


b6é 
b7Cc 


b6 
b7Cc 


b6 
b7C 


b7E 


b6 
b7c 


FD-302 (Rev. 3-10-82) 


FEDERAL BUREAU OF INVESTIGATION 


1/9/84 


Date of transcription 


The following is a_summary of messages left 
by the illegal user known asf anal 
[Jon GTE Telemail. The date and time of each message 


is provided, with a synopsis of particularly significant 
messages included. 


1.) August 30, 1983, 6:14 PM (all times Eastern 
Daylight Time). 


2.) August 30, 1983, 9:07 PM. 

3.) August 31, 1983, 11:02 AM. 

4.) August 31, 1983, 9:02 AM. 

5.) August 31, 1983, 3:54 PM. 

6.) September 1, 1983, 7:48 AM. 

7.) September 1, 1983, 8:04 AM. 

8.) August 31, 1983, 7:54 PM. 

Note, on September 1, 1983, at 11:03 AM, the 
illegal user received a message from the illegal 
user (aka ). This message states 
in part, “He wrote me and told me that if I don't set 
up accounts a certain way then the company will notice 
when the bill_comes and they will drop the accounts." In 
this message[__—_—_—jis clearly telling[__](aka 

that these messages are being placed in the account 
of a company without that company knowing about it and 


approving of it and further the company will be billed 
for the message. 


9.) September 2, 1983, 12:10 PM. 


10.) September 5, 1983, 7:07 PM. 


11.) September 6, 1983, 11:38 AM. In this message 
refers tol is the true name off] »« 


wife. 


b6 
b7Cc 


b6 
b7C 


b7C 


invdcnestiod ca b27 8783 a_ Alexandria, Virginia ruefiexandria 196A-633 
: b6 
SA gaj pate aictatea__ 12/8/83 bIC 


by 
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12.) September 6, 1983, 3:58 PM. 

13.) September 7, 1983, 11:10 AM. 

14.) September 7, 1983, 1:59 PM. 

15.) September 7, 1983, 2:32 PM. 

16.) September 8, 1983, 7:49 AM. 

17.) September 8, 1983, 6:12 PM. 

18.) September 11, 1983, 6:34 PM. 

19.) September 11, 1983, 6:35 PM. 

20.) September 12, 1983, 11:27 AM. 

21.) September 12, 1983, 1:56 PM. Message 
refers in part to the purchase of oxygen. This message 
is in response to a message left on the system by 
stating that the oxygen was ready for pick-up at Rochester 
Fire and Safety. Investigation by the FBI at Rochester 


Fire and Safety reveals that did, in 
fact, pick up a respirator on September 12, 1983. 


b6 
b7C 


22.) September 13, 1983, 7:33 AM. 


23.) September 15, 1983, 9:04 PM. Message 
states in part "I was unable to log into Telenet, til 
now. The lines were busy all day. I don't know what 
all the action was for on Telenet, but it looks like everyone 
was doing there last minute business reports today." 


24.) September 16, 1983, 8:00 AM. Message 
reads in part "I check the Lincom board this morning, 
and much to my surprise I found nothing of: use and/or 
value. I think that you should pass alont (SIC) to the 
Admin, that we need support here in the field, and the 
board should contain important information dealing with 
the everyday usage of this system." 


25.) September 18, 1983, 10:01 AM. Message 
states in part from the Okla, sales office has made 


national news. He was in one of the maq's this month." b6 
This statement refers to the fact a b7C 
aka[ ig was quoted in a national computer magazine 


in an article concerning computer hacking. 


3” 


\a5 


AX 196A-633 


26.) 


September 18, 1983, 10:21 AM. 


4:07 PM. 


27. September 18, 1983, 
refers to aka bé 
the roommate of at Cornell University. b7c 
28.) September 19, 1983, 9:32 AM. 
29.) September 21, 1983, 7:45 PM. 
30.) September 21, 1983, 7:44 PM. 
31.) September 23, 1983, 9:03 AM. 
32.) September 23, 1983, 5:12 PM. 
33.) September 22, 1983, 2:31 PM. 
34.) September 23, 1983, 5:18 PM. 
35.) September 24, 1983, 5:29 PM. 
36. September _25, 1983, 9:19 AM. This message 
refers to meaning> ie 
b7C 
37.) September 26, 1983, 3:55 PM. 


38.) September 26, 1983, 1:52 PM. 
39.) September 27, 1983, 3:00 PM. 
40.) September 27, 1983, 6:27 PM. 
41.) September 28, 1983, 11:44 AM. 
42.) September 28, 1983, 11:33 AM. 
43.) September 28, 1983, 4:39 PM. 
44.) September 30, 1983, 8:35 AM. 
45.) October 2, 1983, 12:27 PM. 

46.) October 2, 1983, 12:23 PM. 


47.) October 2, 1983, 3:47 PM. This message we 
again refers tol} meaning) dC 


roommate at Cornell. 


or \Al 
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48.) October 2, 1983, 3:55 PM. This message 


states "The A/C you know the number isl sd* (Subscriber 


to number is unknown.) 
49.) October 3, 1983, 6:22 PM. 
50.) October 3, 1983, 1:13 PM. 
51.) October 3, 1983, 4:34 PM. 
52.) October 4, 1983, 1:50 PM. 
53.) October 5, 1983, 10:24 AM. 
54.) October 5, 1983, 10:26 AM. 
55.) October 5, 1983, 3:41 PM. 


56.) October 6, 1983, 12:39 PM. This message 
states in part_"How about that for balls, giving a story 


like I did to Well, it would have been 

nice if it had worked though." This statement refers 

to the message left by on October 5, 1983, at 

3:41 PM, wherein he states he talked to 

at American Community and told the false story 

that he was doing a story on companies like American 
Community. was attempting to get information about 


decoders or descramblers for cable t.v. systems. 

57.) October 6, 1983, 12:41 PM. 

58.) October 6, 1983, 6:12 PM. 

59.) October 7, 1983, 8:16 AM. 

60.) October 6, 1983, 6:51 PM. 

61.) October 6, 1983, 7:40 PM. This message 
states in part "The cable company there is semi~smart. 
I will have to work Sl eaeneereS| find out what type 
of decoder system they are using. I think that I could 
get the info, but if I don't you can't go wrong with sine 
wave." 

62.) October 7, 1983, 4:22 PM. 

63.) October 10, 1983, 4:49 PM. 


64.) October 10, 1983, 4:47 PM. 


ae 


\a" 
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65.) October 11, 1983, 11:01 AM. 
66.) October 11, 1983, 1:11 PM. 


67.) October 11, 1983, 1:05 PM. 


\r4 
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The following is a_summary of messages left 
by the illegal user known as and 
on GTE Telemail. The date and time of each 
message is provided, with a synopsis of particularly significant 
messages included. 


b6 
b7C 


1.) August 30, 1983, 7:19 PM (all times Eastern 


Daylight Time). This message contains the name[ | 6 
and is signed "Love is the true BIC 


aka and 


b6 


‘also contains the true name — 


2.) August 31, tc 10:23 AM. This message 
3.) August 31, 1983, 10:24 AM. 
4.) August 31, 1983, 2:23 PM. 


5.) August 31, 1983, 3:38 PM. 


6. September 1, 1983, 10:57 AM. This message 
is from She has now changed her user name from . b6 
b7c 


7.) September 2, 1983, 11:54 AM. 


8.) September 5, 1983, 12:05 PM. This message- b6 
again has the true name[ _ __} b7Cc 


9.) September 6, 1983, 9:16 AM. 
10.) September 6, 1983, 9:22 AM. 
11.) September 6, 1983, 11:14 AM. 
12.) September 6, 1983, 12:43 PM. 
13.) September 6, 1983, 1:31 PM. 


14.) September 7, 1983, 2:17 PM. 


12/8/83 Alexandria, Virginia exandria 196A-633 
investigation on___ at te we 
: b6 
sald 
py IFT ate dictated 12/8/8 3 b7C 
This document contains neither recommendations nor conclusions of the FBI. It is the property of the FBI and is loaned to your agency; 


it and its contents are not to be distributed outside your agency. 


aT AA 


AX 196A-633 2 


15.) September 8, 1983, 9:16 AM. 

16.) September 8, 1983, 1:44 PM. 

17.) September 8, 1983, 1:52 PM. 

18.) September 9, 1983, 9:03 AM. 

19. September 12, 1983, 12:32 PM. This message 
is from tol Janda is as follows "I do 
believe that I told you to expect quite a bit higher than 
you were but I must admit that that is even higher than 


I thought. Also Roch Fire and Safethy (SIC) called and b6 
said that the 02 is ready and the balance due is $164." b7c 
Investigation by the FBI at_a firm called Rochester Fire 

and Safety indicated that did, in fact, 


have an order for a respirator and that the balance due 
was $164.[ —— | picked up that respirator on September 
12, 1983. 

20.) September 12, 1983, 3:24 PM. 

21.) September 12, 1983, 3:08 PM. 

22.) September 16, 1983, 12:48 PM. 


23.) September aL 1983, 9:55 PM. This message 


contains the true name and is signed Love, a 
24.) September 18, 1983, 1:21 PM. 
25.) September 19, 1983, 10:21 AM. This message 
asks "How does feel about your little discovery (rebooting 
his system)? If he's anything Like[ __} it_is probably b6 
a little unsettling." These names refer_to b7C 
roommate at Cornell, and 
husband. ; 


26.) September 19, 1983, 10:23 AM. 
27.) September 19, 1983, 2:31 PM. 
28.) September 20, 1983, 10:02 AM. 


29.) September 20, 1983, 10:09 AM. 


Bro 
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30.) September 20, 1983, 11:38 AM. 
31.) September 20, 1983, 3:46 PM. 
32.) September 21, 1983, 2:59 PM. 
33.) September 22, 1983, 11:13 AM. 
34.) September 22, 1983, 2:53 PM. 
35.) September 23, 1983, 10:23 AM. 
36.) September 23, 1983, 11:33 AM. 
37.) September 23, 1983, 2:41 PM. 
38.) September 26, 1983, 9:17 AM. 
39.) September 26, 1983, 9:17 AM. 
40.) September 26, 1983, 9:25 AM. 
41.) September 26, 1983, 9:41 AM. 
-42.) September 26, 1983, 10:51 AM. 
43.) Senecmber 26, 1983, 12:06 PM. 
44.) September 26, 1983, 3:32 PM. 
45.) September 26, 1983, 5:48 PM. 
46.) September 27, 1983, 4:19 PM. 
47.) September 27, 1983, 7:23 PM. 
48.) September 27, 1983, 4:11 PM. 


49.) September 28, 1983, 10:06 AM. This message se 
is to[ _jand uses the name|__ | referring = nae 
50.) September 28, 1983, 11:55 AM. 


51.) September 29, 1983, 6:27 PM. 


52.) September 30, 1983, 8:58 AM. 


AX 196A-633 4 


October 1, 1983, 3:59 PM. This message 
to to her husband 
- The message reads in part "Well, I finally b6 


got throug I didn't know your name. I had forgotten b7c 
what you_had said it was. You really ought to investigate 
on that user on here. Who knows, with your hacking 


ability you may come up with something interesting." 

54.) October 2, 1983, 1:37 PM. 
55.) October 2, 1983, 6:38 PM. 
56.) October 3, 1983, 9:44 AM. 
57.) September 30, 1983, 8:58 AM. 
58.) October 2, 1983, 1:29 PM. 
59.) October 2, 1983, 1:42 PM. 
60.) October 2, 1983, 6:34 PM. 
61.) October 3, 1983, 9:37 AM. 
62.) October 3, 1983, 3:26 PM. 
63.) October 3, 1983, 3:29 PM. 
64.) October 4, 1983, 11:12 AM. 
65.) October 4, 1983, 2:42 PM. 
66.) October 4, 1983, 11:23 AM. 
67.) October 5, 1983, 3:47 PM. 
68.) October 6, 1983, 1:16 PM. 
69.) October 6, 1983, 1:07 PM. 
70.) October 10, 1983, 2:41 PM. 
71.) October 10, 1983, 5:54 PM. 


72.) October 7, 1983, 3:25 PM. 


902 
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73.) October 11, 1983, 1:46 PM. 


74.) October 11, 1983, 3:08 PM. 


03 


FEOERAL BUREAU OF INVESTIGATION 


Date of transcription 10/19/83 


Pursuant to a search warrant, a search was 


conducted at The premises were nee 
entered at 9: a.m. and exited at 10:52 a.m. 
The following items were taken from the residence 
and receipted for: 
1. Manilla folder with tapes, computer 
printouts and miscellaneous items from cabinet in 
garage - all computer related. 
2. Hayes Smart Modern 300, 552094725 
3. Radio Shack_TRS 80, Model 3, SSAN (SOcial b6 
“Security Account Number)[_ Jon it. 7 
4. Power source Hayes, lead 
5. Two disc drives 
a) Tandon 100-1 
b) Sugart SA-400 
6. Printer Gemini 10x 3013024363 
7. Flip-N-File Programs 
8. Digital timer - Sony 023702 
9. Columbia Stereo amplifier 
10. SPR-4 - Drake Manuals (two) 
10a. Miscellaneous documents from[ tf 
ll. Printout paper 
b6 
b7C 


| _— 
. L 
, Ax GEA -L¥E GF 
investigation on__/ L0/22/83 a Sultato-+96a-529— 


sa[_ “Ra na b6 
; 10/13/83 


Oate dictated.  _-l—=*ee 
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veal. 204 


FD-302 (Rev. 3-10-82) 


FEDERAL BUREAU OF INVESTIGATION 


i 12/7/83 


Date of transcription 


The following is a review of evidence seized pursuant 


to a duly authoriz F the 
premises known_as the b6 
residence of b7Cc 


The following is a summary of evidence relevant to 
this investigation: 


1) Iwo vehice cards with the printing, | b6 
b7C 


2) A printout with the words, "Computer located at," 
and six phone numbers listed. 


3) A printout with numerous bulletin boards and phone 
numbers associated with those bulletin boards. 


4) A white piece of paper with numerous numbers of 
unknown meaning on it. 


Investigation on___ 11/15/83 at_Alexandria, Virginia rie es ALexandria 196A-633 


b6 
py__SA DF :mb Date victatea___—Ss 21/16/83 nc 
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FEDERAL BUREAU OF INVESTIGATION 


i Date of transcription i /2 0/8 4 
The flo discs seized in the search of the 

residence of 

were examined by a computer programmer, b6 

and stated no information pertaining to GTE Telemail bye 

was found. 

a 1/17/84 Alexandria, Va. Alexandria 196A-633 
Investigation on at a File # 

: b6 

by SA gaj Date dictated 1/17/84 b7C 
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i 1/27/84 


Date of transcription 


The following is a review of b6 


b7Cc 
bTE 


A_ review of Bae 


b6 
b7C 
bT7E 


bT7E 


b6 
b7c 
bTE 


1/19/84 Alexandria, Va. , Alexandria 196A-633 


investigation ont Fite 


1/19/84 b6 


Date dictated b7C 
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FEDERAL BUREAU OF INVESTIGATION 
Date of transcription ly 3 ly 8 4 


On January 24, 1984, 
GTE-Telemail, provided a copy of the amount of money |. bé 
lost by GTE Telemail from the unauthorized use by the hackers. b7c 
This document is broken down by user and by company. a 


Many of the hackers had two or more user names; 
therefore the following will be a summary of the above document, 
indicating totals by each user, combining multiple user names 
(this summary covers the months of July, Auqust and September 
for each company): 


USER . COMPANY AMOUNT MON uae. 
UAW a © 3b 9) 
Q b6 
[ Maraven 2LeaDO AUGUST Sere Skeet saa 
: Telenet S10Gs 00" JWI Avouse 
_—e | BMW $0.29 September 
s127.58 


. . . ° . . . . . . . - . . . . . . . . . . . ° 


[i CBOT $2.90 September b6 
b7c 
[ RADA $1.00 September 


$3.00 
[| Maraven — $24.00 August 
Telenet $325.00 July b6 
; : b7Cc 
Telenet $151.00 August 
inbentianting Sn 1/25/84 ows _at_Alexandria, Virginia fies Alexandria 196A LI6A-63:3 
. b6 
by SA sfk Date dictatea__ 1/25/84 nc 
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FEDERAL BUREAU OF INVESTIGATION 


1/9/84 


Oate of transcription 


The following is a summary of messages left | 
ax the td tesa user[_—— idan be 


on GTE Telemail. b7C 


The date and time of each message is provided 
with the synopsis of particularly significant messages 
included. 


1.) August 30, 1983, 12:56 AM (all times Eastern 
Daylight Time). This message discusses how to set up 
illegal user accounts. 


2.) August 30, 1983, 4:19 PM. This message 
states "Hi I got our new accounts up.[____—iwill 
never find these. (1 hope) Tell[ that her account 
is ready a. Signed Z 

refers to 
‘is the illegal user name for 
her password on the Telemail System. 


b6 
b7C 


3.) August 30, 1983, 8:20 PM. This message 
tells how to use the Telemail System. 


4.) August 30, 1983, 10:54 PM. 
5.) August 30, 1983, 8:18 PM. 


6.) August 30, 1983, 4:18 PM. 


Ts August 31, 1983, 12:56 PM. This message b6 
refers to b7C 


8.) September 1, 1983, 3:18 PM. This message 
reads as follows I got a list of RADA accounts and 
yours were there too. So that does not seem to hide them. 
Also,[__ lis set up strangely in that you can only use 
certain configs. Please explain. My accounts are under 


RADA, even though there are only a few. I frankly think sue 
[_Jis dangerous, since does not have a particularly 
good reputation, and saying is run byl wild 
be sure to get it looked at if anything is looked at. As 
of now, accounts (__————*ietc.)" are 
invaitigation on 2 eZ o7 83 a_.Alexandria, Virginia _,, Alexandria 196A-633 
2 b6 
by SA gay Date dictated 12/8/8 3 b7C 
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under RADA. If you get a list of_RADA accounts ou also 
get some that maybe you created etc.). 
I have not looked into it but if those are under 


they are also showing up under RADA since[___lis a subset 
of source. Will call you. " 


9.) September 1, 1983, 4:44 PM. Message reads 
as follows [__} I don't know what you are trying to find 
out (i.e. your findings) but the other accounts are: 

There is nothing wrong 
with the accounts, but_if you find anything, let me know. 
is Snr aoe and is under RADA, 
all others of mine are under RADA. P.S. call_me 


when you get in, if busy try again in five. See yal" 


10.) September 1, 1983, 4:48 PM. 


ll.) September 1, 1983, 10:14 AM. This message 


reads in part "Send me mail with the options for the "Admin 


not noticing." This message refers to continuing attempts 
to keep the legitimate administrator of an account from 
knowing there are hackers in his company's account. 


12.) September _1, 1983, 8:47 AM. This message 
refers to the fact that as_the administrator 
is going to change the user name of[ sito 


13.) September 1, 1983, 11:21 AM. 


14.) September 1, 1983, 11:03 AM. This message 
reads as follows as you can see, your name has been 


changed _ to its proper name (also, please send mail to 
me to - << finally got it I think. And hopefully 
won't screw us up again. He wrote me and told 


me that if I don't set up accounts a certain way then 

the company will notice when the bill comes and they will 
drop the accounts. I think he is bullshitting me because 
he wants to have full control of the system. Oh well 

I told him to tell me what the correct set-up params are 
so I can do it. Talk to you later[__—iy" 


15.) September 1, 1983, 5:19 PM. 
16.) September 6, 1983, 8:37 AM. 


17.) September 5, 1983, 3:29 PM. 


Base 


Aly 


b6 
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18.) September 5, 1983, 8:24 PM. This message b6 
contains the name = 7 b7c 

19.) September 4, 1983, 11:02 PM. 

20.) September 6, 1983, 10:54 AM. 

21.) September 5, 1983, 3:27 PM. This_message 
contains the sentence "I just got back (3:19) sual] b6 
(my roommate) just walked in." This sentence indicates bic 
that is the illegal user name for his roommate, 

22.) September 6, 1983, 3:41 PM. 

- 23.) September 6, 1983, 6:02 PM. 

24.) September 6, 1983, 6:03 PM. 

25.) September 6, 1983, 6:04 PM. 

26.) September 6, 1983, 6:09 PM. 

27.) September 7, 1983, 12:41 PM. 

28.) September 7, 1983, 12:50 PM. 

29.) September 7, 1983, 4:36 PM. 

Note, on September 7, 1983, at 2:14 PM, 
received a message from[______—_—~«+4«| =This message begins 
Gee, I quess there is always a first time. In this b6 
message uses the true first name b7c 


This message also refers to[____]meaning 


30.) September 8, 1983, 8:44 AM. 
31.) September 7, 1983, 11:42 PM. 
32.) September 7, 1983, 11:37 PM. 
33.) September 8, 1983, 10:52 AM. 


34.) September 8, 1983, 10:44 AM. In this 


b6 
messa el —isses the name[___——ireferring tol aA 
| | aka 


AIS 


